Description

Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:09.273Z",
  "pubdate": "2026-08-25T21:18:09.273Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) memory corruption flaw identified within the Views component of Google Chrome for macOS.\nThe flaw allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox environment.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65.\nThe risk is categorized as Medium severity by the Chromium project, reflecting the balance between the significant impact of sandbox escape and the specific conditions required for successful exploitation.\nThe attack is triggered via a crafted HTML page, necessitating user interaction such as navigating to a malicious website.\nSuccessful exploitation grants an attacker the ability to execute arbitrary code with the privileges of the application process, potentially leading to unauthorized data access, system compromise, or further exploitation of the host operating system.\nThe primary security implication is the subversion of the Chrome sandbox, which is intended to isolate malicious web content from the underlying host system.",
  "technicalDetails": "The vulnerability originates from an improper memory management implementation within the Views UI framework utilized by Chromium. A use-after-free condition occurs when the browser engine continues to hold a reference or pointer to a memory heap allocation after that memory has been explicitly deallocated or freed.\nIn the context of the Views component, this flaw likely involves the improper lifecycle management of user interface objects or widgets. If a malicious web page triggers a sequence of operations that causes a specific View object to be destroyed while other parts of the application still maintain a dangling pointer to that memory address, the attacker can leverage this state.\nThe exploitation flow typically involves heap grooming, where the attacker uses JavaScript or other web primitives to manipulate the heap layout. By forcing the browser to allocate and deallocate specific objects, the attacker attempts to reclaim the memory previously occupied by the freed View object with malicious data controlled by the attacker.\nWhen the browser later attempts to access the freed memory via the dangling pointer, it processes the attacker-supplied data as if it were a legitimate object or function pointer. This facilitates a control-flow hijack. By overwriting virtual function tables (vtable) or function pointers stored within the object, the attacker redirects the execution flow to arbitrary code, such as a ROP (Return-Oriented Programming) chain.\nBecause the vulnerability occurs within the Views layer, the exploit is capable of bypassing the standard browser sandbox protections. The sandbox is designed to restrict the impact of renderer-based exploits; however, if the vulnerability exists in a component that interacts with the browser process or privileged UI components, the attacker can break out of the constrained environment.\nThis vulnerability does not require authentication and can be weaponized through remote network exposure by enticing a user to navigate to a specifically crafted HTML page. Once the exploit code is executed, the impact is severe, potentially resulting in full system compromise depending on the escalation paths available from the initial execution context.\nAffected versions are strictly those prior to 152.0.7977.65 on macOS. The root cause is inherently linked to the asynchronous and complex nature of widget lifecycle management within the Chromium rendering and UI stack, where race conditions or pointer invalidation errors remain a persistent threat vector."
}