Description

Use after free in Network in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:02.030Z",
  "pubdate": "2026-08-25T21:18:02.030Z",
  "executiveSummary": "A use-after-free vulnerability exists within the Network component of Google Chrome on macOS prior to version 152.0.7977.65. The flaw permits a remote attacker to achieve arbitrary code execution outside the browser's security sandbox. The vulnerability necessitates a social engineering vector to induce the installation or interaction with a maliciously crafted Chrome extension. Successful exploitation allows an attacker to bypass browser-level isolation mechanisms, posing a significant risk to system integrity and user data confidentiality. By leveraging the extension framework, the attacker can execute arbitrary code in the context of the host operating system, effectively escalating privileges beyond the standard renderer process constraints. The Chromium project has categorized this vulnerability as having Medium severity, primarily due to the requisite user interaction.",
  "technicalDetails": "The vulnerability originates from a use-after-free (UAF) condition within the Network component of the Chromium architecture. A UAF vulnerability occurs when an application continues to use a pointer after the memory area it references has been deallocated or freed. In this specific instance, the network stack fails to properly manage object lifecycles during complex network operations, leaving a dangling pointer that can be manipulated by an attacker.\nThe attack flow begins with the delivery of a maliciously crafted Chrome extension. Because this requires social engineering, the attacker must first coerce the user into installing or enabling the malicious extension. Once active, the extension interacts with specific network primitives that trigger the vulnerable code path. By precisely timing these network requests, the attacker can cause the browser to free an object while maintaining a reference to it.\nFollowing the deallocation, the attacker performs heap grooming or memory spraying techniques to replace the freed memory block with controlled data. When the application subsequently attempts to dereference the dangling pointer, it accesses the attacker-controlled memory instead of the intended object. This state allows the attacker to hijack the control flow of the browser process.\nThe impact of this manipulation is severe because it facilitates execution outside the browser's sandbox. Typically, Chrome's sandboxing restricts the capabilities of the renderer process; however, by exploiting this vulnerability within the context of a compromised extension—which often operates with broader permissions—the attacker can execute arbitrary code on the underlying macOS host. This bypasses the typical security boundaries that prevent web content from accessing sensitive local files or system APIs.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65 on macOS. There is no requirement for prior authentication, but the exploitation path is strictly dependent on the successful deployment of the malicious extension via social engineering tactics. Post-exploitation, the attacker gains the ability to execute payloads with the privilege level of the Chrome application process, which may lead to full system compromise if further local privilege escalation techniques are utilized."
}