Description

Use after free in Safebrowsing in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:56.973Z",
  "pubdate": "2026-08-25T21:17:56.973Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Safebrowsing component of Google Chrome on the macOS platform. This memory corruption flaw exists due to improper management of object lifecycles within the browser's security verification subsystem.\nThe vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox. By enticing a user to interact with a maliciously crafted HTML page through social engineering tactics, an attacker can trigger the memory safety violation.\nGiven the severity and the potential for sandbox escape, this flaw poses a critical risk to user data integrity, system confidentiality, and overall platform security. The exploit requires no local authentication but relies on successful user interaction to initiate the malicious payload delivery.\nThis issue affects Google Chrome versions prior to 152.0.7977.65 on macOS. Organizations and individual users are strongly advised to update to the latest patched version immediately to mitigate the risk of remote compromise.",
  "technicalDetails": "The vulnerability originates from a Use-After-Free condition residing in the Safebrowsing component of the Chromium browser architecture. Safebrowsing is responsible for identifying and blocking malicious URLs and phishing attempts by performing real-time lookups and heuristic analysis of requested web content.\nThe root cause is a race condition or an improper object reference management within the browser's heap memory. When the Safebrowsing engine processes a specially crafted HTML page, a pointer to a dynamically allocated object is incorrectly maintained after the memory has been deallocated or freed. Subsequent attempts by the engine to reference this dangling pointer lead to a heap-based memory corruption scenario.\nThe exploitation flow begins when an attacker directs a target user to a compromised or attacker-controlled HTML page. This page is designed to manipulate the browser's DOM or internal state to trigger the vulnerable code path within the Safebrowsing component. By precisely controlling the heap layout—often through heap spraying techniques—an attacker can place arbitrary malicious data at the memory address previously occupied by the freed object.\nOnce the dangling pointer is dereferenced, the Safebrowsing logic inadvertently executes or processes the attacker-supplied data as if it were legitimate code or an object method. This deviation from expected memory state enables an attacker to hijack the instruction pointer, leading to arbitrary code execution. Because this specific UAF occurs within a context that, through further exploit chaining, allows for a sandbox escape, the attacker gains the ability to execute code with elevated privileges on the underlying macOS host system, bypassing the browser's primary security boundary.\nThe attack is remotely exploitable over the network and does not require the attacker to have existing authentication or prior access to the target system. The primary barrier to exploitation is the social engineering component, which is necessary to induce the user to navigate to the malicious payload. Once the payload is triggered, the post-exploitation impact includes full control over the user's browser session, potential exfiltration of sensitive local data, and persistent execution on the macOS device."
}