Description

Improper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:03.037Z",
  "pubdate": "2026-08-25T21:18:03.037Z",
  "executiveSummary": "A critical security flaw involving improper state validation within the Google Chrome Parser has been identified, affecting versions prior to 152.0.7977.65. This vulnerability is classified as a memory-safety issue, specifically related to the mishandling of internal state machine transitions during HTML parsing.\nThe vulnerability enables a remote attacker to achieve arbitrary code execution within the confines of the browser's sandbox environment. By enticing a user to navigate to a specifically crafted HTML document, an attacker can trigger a state inconsistency that allows for memory corruption. This exploit does not require prior authentication and can be leveraged by a malicious actor over the network.\nAlthough the execution is restricted by the sandbox, successful exploitation poses a significant risk to user data integrity and browser session security. The primary implication is the potential for an attacker to bypass browser protections to execute malicious payloads, which may facilitate further privilege escalation or data exfiltration from the renderer process.\nGiven the nature of web-based delivery, the attack surface includes any environment where users interact with untrusted or compromised web content.",
  "technicalDetails": "The vulnerability resides within the Chromium HTML Parser, specifically due to a logic flaw in how the parser validates internal states during complex document processing. The root cause is an improper state validation routine that fails to reconcile the internal Parser state machine when encountering malformed or specifically crafted HTML tags and attributes.\nWhen the parser processes a crafted HTML page, the inconsistent state may lead to an out-of-bounds memory access or a use-after-free condition within the renderer process. Because the browser's parser relies on high-performance C++ code to handle the Document Object Model (DOM) construction, any discrepancy between the expected state machine transition and the actual provided markup can lead to memory corruption, which is a common precursor to arbitrary code execution.\nThe attack flow initiates when a victim loads a malicious URL. The browser's renderer process begins parsing the HTML document, encountering the crafted sequence that triggers the validation bypass. As the state machine enters an undefined or invalid state, the parser performs an illegal operation on the heap. An attacker who successfully controls the memory layout or exploits the deterministic nature of the heap allocation can redirect the instruction pointer to an attacker-controlled buffer.\nExploitation requires no user interaction beyond navigating to the malicious page, making it a high-risk vector for drive-by download or phishing campaigns. Since the parser handles all incoming HTML, the vulnerable component is always active. While the vulnerability exists within the sandbox, executing arbitrary code allows the attacker to leverage the renderer process as a foothold. From this position, an attacker might attempt to chain this with a sandbox escape vulnerability to gain elevated privileges on the underlying host operating system.\nThe vulnerability affects Chromium-based products, specifically Google Chrome versions prior to 152.0.7977.65. The lack of proper state verification during the transition of document parsing modes (e.g., transitioning between raw text, CDATA, and standard DOM elements) allows the payload to influence the parser's logic, leading to the corruption of browser-managed objects."
}