Description

Race condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:17:55.420Z",
  "pubdate": "2026-08-25T21:17:55.420Z",
  "executiveSummary": "A race condition vulnerability exists within the WebProtect component of Google Chrome prior to version 152.0.7977.65. This security flaw enables a remote attacker who has already successfully compromised the renderer process to perform unauthorized information disclosure.\nThe vulnerability is categorized as a Medium severity issue due to the requirement of a prior compromise of the renderer process. By leveraging a crafted HTML page, an attacker can exploit the race condition to access memory or sensitive data that should otherwise remain protected within the sandboxed environment.\nThe primary risk implication involves the potential exfiltration of sensitive information, which could facilitate further exploitation of the host system or the compromise of user data. Since the exploit originates from within the renderer process, it highlights the need for robust memory management and thread synchronization in high-risk browser components. Mitigation requires upgrading to the specified patched version or later to ensure the race condition is resolved at the architectural level.",
  "technicalDetails": "The vulnerability resides within the WebProtect component, which handles security-critical operations during page rendering in Google Chrome. The root cause is identified as a race condition—a concurrency flaw that occurs when multiple threads or processes attempt to access and manipulate shared resources simultaneously without adequate synchronization mechanisms, such as mutexes, semaphores, or atomic operations.\nIn the context of the Chromium renderer process, this flaw manifests when the rendering engine executes asynchronous operations on shared security data structures. If an attacker can precisely time the execution of a crafted HTML page containing malicious scripts, they can trigger a race window between the check and the use of a resource protected by WebProtect. Specifically, the race condition allows the attacker to access information that the security logic intends to guard, effectively bypassing intended data access restrictions.\nThe attack flow begins with the attacker compromising the renderer process, typically via a separate remote code execution vulnerability or a memory corruption bug in the browser engine. Once the renderer is compromised, the attacker delivers a specially crafted HTML page designed to trigger the race condition. By repeatedly invoking specific API calls or triggering page lifecycle events, the attacker can force the rendering engine to enter an inconsistent state. During this window of inconsistency, the WebProtect component may fail to enforce security boundaries, allowing the attacker to read sensitive memory contents or bypass process-level isolation.\nBecause the renderer process operates with reduced privileges in the Chromium sandbox, the impact is strictly limited to the information accessible within that process context. However, successful exploitation permits the unauthorized retrieval of data that may include cross-origin credentials, internal rendering state, or user-sensitive information present in the renderer's memory. This bypasses the protections provided by the sandbox's memory isolation, effectively granting the attacker read access to memory regions that should have remained restricted. The vulnerability is present in all versions of Google Chrome prior to 152.0.7977.65. There are no authentication requirements for the final trigger, as the exploit is initiated through client-side content processing by the victim's browser."
}