Description

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:17:58.690Z",
  "pubdate": "2026-08-25T21:17:58.690Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the WebRTC component of the Google Chrome browser.\nThe flaw allows a remote attacker to achieve arbitrary code execution within the confines of the browser sandbox.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65.\nExploitation requires the victim to process specially crafted network traffic, which triggers the memory corruption.\nGiven the nature of UAF vulnerabilities in browser engines, successful exploitation poses a high risk to confidentiality, integrity, and availability, as it enables memory corruption leading to potential sandbox escapes or unauthorized code execution.\nNo user interaction beyond visiting a malicious site or engaging in a network session is required, making this an attractive vector for remote compromise.",
  "technicalDetails": "The root cause of this vulnerability is a Use-After-Free (UAF) condition within the WebRTC implementation in Chromium. A UAF vulnerability occurs when an application continues to use a pointer to a memory location after that memory has been deallocated or freed. In the context of WebRTC, this typically involves a race condition or an incorrect object lifetime management during the processing of network packets, such as RTP/RTCP streams or signaling messages.\nThe exploitation flow begins when a remote attacker sends specially crafted network traffic designed to induce a specific state in the WebRTC state machine. As the browser processes this malicious traffic, an object is prematurely freed while a dangling pointer remains active in a different execution thread or context. When the application subsequently attempts to dereference this dangling pointer, it accesses memory that may have already been reclaimed or overwritten by the attacker.\nBy controlling the content of the reallocated memory, an attacker can replace the freed object with controlled data. When the application uses the dangling pointer, it effectively uses the attacker's data as if it were the legitimate object. This often manifests as an indirect function call or a virtual method table (vtable) overwrite. If the attacker succeeds in redirecting the instruction pointer (EIP/RIP) to a location of their choosing, they can execute arbitrary code within the context of the renderer process.\nThe impact is scoped within the browser sandbox, which serves as a security boundary to prevent unauthorized access to the host operating system. However, code execution within the sandbox is a significant primitive that can be chained with secondary sandbox escape vulnerabilities to gain full control over the host machine.\nBecause the vulnerability exists in the network processing stack, it is reachable via any network-connected WebRTC session. The lack of specific authentication requirements makes this a potent remote exploit vector. The vulnerability is present in all Chromium-based implementations that have not integrated the security patch provided in release 152.0.7977.65. Defensive mechanisms such as AddressSanitizer (ASan) or Control Flow Guard (CFG) would typically detect or mitigate the memory corruption or unauthorized flow redirection, but standard browser configurations remain vulnerable until the memory management logic is corrected in the source code."
}