Description

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:01.030Z",
  "pubdate": "2026-08-25T21:18:01.030Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Aura windowing system within Google Chrome. This flaw allows a remote attacker to achieve arbitrary code execution by enticing a user to navigate to a specifically crafted HTML page. The vulnerability resides in memory management logic where an object is accessed after its memory has been deallocated, leading to a dangling pointer condition. Due to the nature of the flaw and its potential for sandbox escape, the security impact is classified as critical. Successful exploitation provides an attacker with the ability to execute unauthorized instructions in the context of the affected process, potentially compromising the integrity and confidentiality of the host system. The attack requires no authentication and can be triggered through standard web interaction, making it a high-risk vector for remote exploitation.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) condition originating in the Aura windowing subsystem of the Chromium browser framework. A UAF vulnerability occurs when the application continues to hold and subsequently references a pointer to a memory location after that memory has been freed or reallocated. In the context of Aura, the life cycle management of UI objects or windowing components is compromised when an object is destroyed while a reference remains active in a separate thread or event loop.\nThe exploitation flow typically begins with an attacker deploying a malicious HTML page containing complex DOM structures or specific sequences of events designed to trigger an asynchronous callback or event listener that interacts with a target object. Through heap grooming or memory spraying techniques, the attacker attempts to manipulate the heap state so that the freed memory is re-allocated for an object controlled by the attacker. When the browser subsequently attempts to access the original pointer—believing it still points to a legitimate Aura component—it instead interacts with the attacker's controlled data.\nBy manipulating the content within the reallocated memory, the attacker can hijack the control flow of the browser process. This is often achieved by overwriting function pointers or virtual method tables (vtable) associated with the object. When the application invokes a method on the dereferenced pointer, execution is redirected to an attacker-supplied gadget chain (e.g., Return-Oriented Programming or Jump-Oriented Programming).\nGiven that this vulnerability affects the Aura component, successful exploitation potentially leads to a sandbox escape, allowing the payload to execute arbitrary code outside the restricted Chromium sandbox environment. This bypasses the primary security boundary intended to contain malicious web content. The vulnerability affects Google Chrome versions prior to 152.0.7977.65. There are no authentication requirements, as the attack is initiated through the browser's document rendering engine, and the threat is accessible via remote network interaction whenever the user renders the malicious content.\nThe post-exploitation impact includes full code execution with the privileges of the browser process, which may facilitate persistent system access, data exfiltration, or lateral movement depending on the specific environment and OS-level security policies."
}