Description

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:05.227Z",
  "pubdate": "2026-08-25T21:18:05.227Z",
  "executiveSummary": "A critical memory corruption vulnerability identified as a Use-After-Free (UAF) exists within the V8 JavaScript engine of Google Chrome. The flaw resides in the handling of object memory lifecycles, which, if improperly managed, allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65. By leveraging a specially crafted HTML page, an unauthenticated remote attacker can trigger the UAF condition to manipulate heap memory. Successful exploitation grants the attacker the ability to execute malicious code within the renderer process, potentially leading to sandbox escapes or information disclosure depending on further exploit chaining. Given the reach of Chrome's user base and the nature of V8's core integration, this vulnerability poses a significant risk to client-side security. The requirement for a crafted HTML page implies that user interaction, such as navigating to a malicious URL, is the primary vector for exploitation. Organizations should prioritize updating to the patched version to neutralize the risk of browser-based memory corruption attacks.",
  "technicalDetails": "The vulnerability is rooted in a Use-After-Free (UAF) defect within the V8 engine’s garbage collection or object lifetime management logic. In the context of V8, a UAF occurs when the engine retains a pointer to a memory region (such as a JavaScript object or internal structure) after that memory has been freed or reallocated for a different purpose.\nThe attack flow initiates when a remote attacker delivers a weaponized HTML page containing malicious JavaScript designed to manipulate the heap layout. By triggering specific garbage collection patterns or object allocation sequences, the attacker forces the V8 engine into a state where it performs an operation on a 'dangling pointer'—a reference to memory that the engine believes is still valid but has, in fact, been returned to the heap allocator.\nExploitation involves achieving a 'type confusion' state or an arbitrary read/write primitive within the context of the renderer process. By reallocating the freed memory block with a crafted object controlled by the attacker, the dangling pointer is repurposed to point to attacker-supplied data. When V8 attempts to use this pointer, it performs operations on the attacker's data as if it were a legitimate internal object or function pointer. This state allows for the hijacking of control flow, leading to arbitrary code execution within the constrained environment of the Chrome sandbox.\nThe affected component is the V8 JavaScript execution environment, specifically the memory management sub-systems. Because V8 is responsible for Just-In-Time (JIT) compilation and complex object modeling, memory management errors are highly impactful. The vulnerability does not require prior authentication or elevated local privileges, as the renderer process runs with lowered privileges; however, the sandbox boundary itself acts as the primary containment layer. Once code execution is achieved inside the sandbox, the attacker may seek further vulnerabilities in the Chromium IPC (Inter-Process Communication) layer to elevate privileges and gain persistence on the underlying host operating system. The vulnerability exists in all iterations of Google Chrome prior to version 152.0.7977.65, making it imperative that browser instances are updated to the latest security-hardened releases provided by the vendor."
}