Description

Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:03.623Z",
  "pubdate": "2026-08-25T21:18:03.623Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Federated Credential Management (FedCM) API of Google Chrome, identified in versions prior to 152.0.7977.65. The flaw permits a remote attacker to achieve arbitrary code execution by orchestrating a social engineering campaign that directs a user to a maliciously crafted HTML page.\nThis vulnerability is categorized as a high-severity memory corruption issue. By manipulating the object lifecycle management within the FedCM component, an attacker can trigger a dangling pointer reference, leading to memory corruption. Successful exploitation results in a sandbox escape, allowing the attacker to execute arbitrary code within the context of the underlying host operating system.\nThe attack is contingent upon user interaction, specifically the victim engaging with the compromised content to initiate the FedCM flow. Given the nature of browser-based exploitation, this flaw presents a significant risk to confidentiality, integrity, and availability, as it effectively bypasses the browser's security sandbox constraints.",
  "technicalDetails": "The vulnerability resides in the memory management logic of the Federated Credential Management (FedCM) implementation in Chromium. A Use-After-Free condition occurs when the browser's rendering engine improperly handles the lifecycle of objects associated with the FedCM authentication prompt or its internal callback mechanisms.\nThe root cause is a race condition or an incorrect reference count during the transition between the browser process and the renderer process when handling FedCM API calls. When a specifically crafted HTML page triggers a FedCM request, the attacker can manipulate the state of the associated object before it is fully destroyed or deallocated. If the application continues to reference this memory address after the object has been freed, a dangling pointer is created.\nExploitation involves heap grooming to reallocate the freed memory block with attacker-controlled data. By forcing the browser to perform specific operations—such as navigating away, reloading, or triggering secondary FedCM events—while the dangling pointer remains active, the attacker can hijack the control flow. The attacker uses this to overwrite critical structures, such as function pointers or virtual method tables, effectively redirecting execution to a shellcode payload or a Return-Oriented Programming (ROP) chain.\nThe attack flow follows these steps: 1. The attacker hosts a malicious HTML page containing JavaScript designed to trigger the vulnerable FedCM flow. 2. The attacker uses social engineering to induce the user to interact with the page, initiating the FedCM dialog. 3. Through carefully timed inputs or navigation triggers, the attacker forces the premature release of the memory object. 4. The attacker sprays the heap to replace the freed object with malicious data. 5. The browser accesses the dangling pointer, triggering a reference to the attacker's controlled data, which facilitates arbitrary code execution. 6. By bypassing security sandbox restrictions, the attacker gains the ability to execute instructions outside the restricted browser process, potentially escalating privileges or installing persistent threats on the target system."
}