Description

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:08.093Z",
  "pubdate": "2026-08-25T21:18:08.093Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists within the Sessions component of Google Chrome for Android, identified in versions prior to 152.0.7977.65.\nThis vulnerability is classified with a Medium severity rating by the Chromium security team.\nThe flaw allows a remote attacker to achieve arbitrary code execution outside the confines of the browser sandbox.\nSuccessful exploitation requires the attacker to employ social engineering techniques to manipulate user UI interactions.\nBy triggering this memory corruption vulnerability, an attacker can bypass security boundaries, potentially leading to a full compromise of the application or device context depending on subsequent privilege escalation.\nThe vulnerability highlights risks inherent in complex state management within browser session handling.",
  "technicalDetails": "The vulnerability originates from an improper memory management condition categorized as Use-After-Free (UAF) within the Sessions component of the Chromium browser engine on the Android platform.\nA UAF condition occurs when an application continues to use a pointer after the memory block it references has been deallocated or freed. In the context of Chrome's session management, the vulnerability involves the lifecycle of objects tracking browser state or UI-bound session data.\nThe attack flow requires an attacker to engage in social engineering to induce specific UI interactions from the user. When the target performs the manipulated interaction, it triggers a code path that attempts to access a dangling pointer—a reference to an object that has already been destroyed.\nIf the attacker successfully sprays the heap or influences the memory allocator prior to the use of the dangling pointer, they can replace the freed memory with attacker-controlled data. This permits the overwriting of virtual function tables (vtables) or other sensitive data structures.\nBy redirecting execution flow, the attacker can hijack control flow, leading to arbitrary code execution. A critical aspect of this specific vulnerability is that the execution occurs outside the standard Chromium sandbox, signifying a significant breach of the browser's security architecture and isolation boundaries.\nThe vulnerable component is identified as the Sessions management logic. This sub-system is responsible for maintaining the state of open tabs, browser history, and associated window contexts. Complexity in these modules, particularly regarding object ownership and asynchronous cleanup, often introduces race conditions or memory management errors that result in UAF vulnerabilities.\nThe vulnerability affects all versions of Google Chrome on Android prior to 152.0.7977.65. There are no authentication requirements for the attacker, but the exploit is contingent upon user-initiated interaction facilitated by social engineering tactics to reach the vulnerable code path.\nPost-exploitation, the impact is significant because it grants the attacker the ability to execute arbitrary commands within the security context of the Chrome application, circumventing the sandbox protections designed to isolate web content from the underlying operating system and private user data."
}