Description

Use after free in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:58.580Z",
  "pubdate": "2026-08-25T21:17:58.580Z",
  "executiveSummary": "A critical Use-After-Free (UAF) memory corruption vulnerability exists within the Extensions component of the Google Chrome browser.\nThis vulnerability, rated as High severity, allows a remote attacker to achieve arbitrary code execution outside the browser sandbox.\nThe flaw affects all versions of Google Chrome prior to 152.0.7977.65.\nSuccessful exploitation requires the victim to be lured into interacting with a malicious Chrome extension via social engineering techniques.\nBy triggering the UAF condition, an attacker can manipulate memory to gain unauthorized control over the execution flow, potentially leading to a full compromise of the user's local system.\nThe risk is significant due to the capability for out-of-sandbox execution, which bypasses standard browser security boundaries designed to isolate web content from the host operating system.",
  "technicalDetails": "The vulnerability is a Use-After-Free (UAF) condition residing in the Extensions subsystem of the Chromium browser architecture.\nA UAF occurs when a program continues to use a pointer to a memory location after the dynamic memory at that location has been deallocated (freed).\nIn the context of Chrome Extensions, this usually involves an object being prematurely garbage collected or explicitly freed while a reference to that object remains active within the extension's execution context.\nThe exploitation flow typically begins with a social engineering attack, where a user is persuaded to install or interact with a crafted, malicious Chrome extension.\nOnce the extension is active, the attacker triggers a sequence of events—such as specific API calls or object manipulations—that forces the extension to hold a 'dangling pointer' to a deallocated memory region.\nThe attacker then performs heap grooming or heap spraying to populate the previously freed memory location with malicious data or controlled function pointers.\nWhen the extension later attempts to access the object via the dangling pointer, it inadvertently executes code from the attacker-controlled memory space.\nBecause the vulnerability exists within a component that manages extension lifecycle and resources, successful exploitation allows the attacker to break out of the browser sandbox.\nSandbox escape is critical because it elevates the attacker's privileges from the restricted browser environment to the level of the user account running the Chrome process.\nThis allows for the execution of arbitrary code, installation of persistence mechanisms, or exfiltration of sensitive local data.\nThe flaw affects versions prior to 152.0.7977.65. There is no requirement for prior authentication, as the attack is facilitated by the user-initiated installation or interaction with the malicious extension.\nThe browser's memory management logic fails to synchronize the object lifecycle correctly across the Extension subsystem's internal state machines, leading to the race condition or dangling reference that defines this vulnerability."
}