Description

Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T21:18:10.043Z",
  "pubdate": "2026-08-25T21:18:10.043Z",
  "executiveSummary": "An off-by-one error vulnerability exists within the DevTools component of Google Chrome, affecting versions prior to 152.0.7977.65. This flaw permits a remote attacker to potentially perform out-of-bounds memory reads from within the browser sandbox. The vulnerability necessitates a social engineering component to trick a user into installing a malicious Chrome extension. By successfully exploiting this weakness, an attacker may access sensitive data residing in memory that should otherwise be isolated by the sandbox mechanism. The risk profile is categorized as Low by Chromium security, primarily due to the requirement for user interaction and the limitations imposed by the browser sandbox environment. However, the potential for unauthorized data access from memory represents a breach of the intended browser security boundary.",
  "technicalDetails": "The vulnerability originates from an off-by-one error located within the Google Chrome DevTools framework. An off-by-one error typically occurs when an iterative loop or pointer arithmetic operation iterates one time too many or too few, often resulting in an access to a memory location immediately adjacent to an intended buffer or array. In this specific context, the flaw is present in the memory handling logic governing DevTools interactions, specifically when managing buffers or internal objects used to represent extension-related data structures.\nThe exploitation lifecycle begins with the deployment of a malicious Chrome extension. Because the browser sandbox restricts arbitrary memory access, the attacker must leverage social engineering to convince a user to install a specially crafted extension. Once installed, the extension interacts with the vulnerable DevTools interface. By sending a malformed or specifically sequenced input to the DevTools API, the attacker triggers the off-by-one condition during the processing of these inputs. Because the error involves reading past the boundary of a designated memory buffer, the process retrieves data residing in adjacent memory regions.\nThe impact of this read primitive is localized within the browser sandbox. Since DevTools components often handle high-privilege information, the out-of-bounds memory read may expose sensitive data, such as internal tokens, credentials, or other transient session information stored within the memory address space of the compromised process. The attacker does not achieve arbitrary code execution via this specific vulnerability; rather, they gain unauthorized access to memory contents. The exploitation is constrained by the integrity of the sandbox, and success depends on the attacker's ability to reliably predict or observe the contents of the memory adjacent to the vulnerable buffer.\nThe vulnerable component is identified as the DevTools subsystem within the Chromium architecture. All Google Chrome versions prior to 152.0.7977.65 are susceptible to this flaw. There is no requirement for pre-existing authentication or elevated local privileges, provided the social engineering threshold for extension installation is met. The exploit is effectively delivered via the browser's extension framework, utilizing the communication channels established between the extension and the DevTools backend."
}