Description

Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:01.487Z",
  "pubdate": "2026-08-25T21:18:01.487Z",
  "executiveSummary": "A use-after-free vulnerability exists within the ServiceWorker implementation in Google Chrome versions prior to 152.0.7977.65. The flaw originates from improper memory management during the lifecycle of a ServiceWorker, where a dangling pointer is accessed after the associated memory has been deallocated.\nThe vulnerability poses a significant security risk, as a remote, unauthenticated attacker can exploit this condition by directing a user to a specially crafted HTML page. Successful exploitation allows the attacker to achieve arbitrary code execution outside the browser's security sandbox, effectively bypassing standard browser isolation mechanisms.\nWhile the Chromium security severity is currently classified as Low, the potential impact of sandbox escape and arbitrary code execution remains critical for affected systems. Organizations utilizing versions of Google Chrome earlier than 152.0.7977.65 are at risk and should prioritize immediate updates to mitigate potential exploitation.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free (UAF) condition within the ServiceWorker component of the Chromium engine. In complex asynchronous systems like ServiceWorkers, memory objects are managed through reference counting or garbage collection. This specific flaw occurs when a memory resource is prematurely freed while a secondary process or task maintains a stale reference to that memory address.\nExploitation is achieved via a malicious HTML document that leverages web-exposed ServiceWorker APIs to trigger an race condition or unexpected state transition within the browser's internal object lifecycle. By manipulating the sequence of events—such as script registration, termination, or interception—an attacker forces the ServiceWorker to attempt a read or write operation on an invalidated pointer. In a controlled heap-spraying scenario, the attacker replaces the freed memory block with malicious data, causing the execution flow to redirect to an attacker-controlled code segment when the dangling pointer is subsequently dereferenced.\nThe attack flow proceeds as follows: 1) The user navigates to a malicious URL. 2) The crafted HTML page executes JavaScript designed to perform specific manipulations on ServiceWorker registration or lifecycle events. 3) These operations induce the browser to free a specific memory object while keeping a dangling pointer active in a background thread. 4) The attacker populates the heap to place a payload at the address previously occupied by the freed object. 5) The browser performs a dangling pointer dereference, triggering the execution of the payload. Because the ServiceWorker operates with specific internal privileges, successful execution of the payload facilitates a sandbox escape, allowing the attacker to interact with the underlying host operating system or bypass sandbox constraints.\nThis vulnerability affects Google Chrome versions prior to 152.0.7977.65. It does not require user authentication or elevated local privileges, as the browser processes the malicious content automatically upon page load. The impact is limited to the client-side environment but carries the high consequence of remote code execution beyond the security boundary."
}