Description

Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:07.987Z",
  "pubdate": "2026-08-25T21:18:07.987Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Views UI framework of Google Chrome for Mac, identified prior to version 152.0.7977.65.\nThe flaw stems from improper memory management within the browser's UI rendering components, potentially allowing a remote attacker to achieve arbitrary code execution outside the security sandbox.\nThis vulnerability poses a significant risk to user confidentiality and system integrity, as successful exploitation enables an attacker to bypass browser-level security boundaries.\nThe attack is triggered by a specially crafted HTML page, requiring user interaction or navigation to a malicious resource. Given the impact, the Chromium project has classified this vulnerability as having Medium security severity.\nNo authentication is required for remote exploitation, and the attack surface is exposed to any user navigating to a compromised web context.",
  "technicalDetails": "The vulnerability resides in the Views framework, which serves as the cross-platform UI toolkit for Chromium. The root cause is a Use-After-Free (UAF) condition involving object lifecycle management within the component tree.\nA UAF occurs when an application continues to utilize a memory pointer after the associated heap memory has been deallocated. In this specific scenario, a race condition or an improper reference count during a View lifecycle event allows the rendering engine to access a dangling pointer.\nThe exploitation flow begins when an attacker directs a user to a malicious HTML page containing crafted elements designed to trigger specific state changes in the browser UI. Through manipulated DOM events or layout triggers, the attacker forces the View object to be destroyed while retaining a reference to it in an active process thread.\nSubsequent access to this dangling pointer during standard rendering operations allows the attacker to influence the program execution flow. By heap spraying or controlled memory manipulation, an attacker can replace the freed object with arbitrary data, effectively redirecting control flow to attacker-controlled payloads.\nThe severity is elevated because the vulnerability facilitates execution outside the sandbox. This implies that once the UAF is triggered, the attacker can move from the restricted renderer process into the browser process or the underlying operating system environment on macOS.\nAffected versions include all Google Chrome instances on macOS prior to 152.0.7977.65. The vulnerability does not require prior authentication, relying entirely on the target browsing a malicious URI, which makes it highly effective for drive-by download attacks or phishing-based campaigns.\nPost-exploitation, the attacker gains the ability to execute code with the permissions of the browser application, potentially leading to unauthorized data access, persistence on the host machine, or further system compromise."
}