Description

Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:10.270Z",
  "pubdate": "2026-08-25T21:18:10.270Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Views component of Google Chrome on macOS. The flaw allows a remote attacker to execute arbitrary code outside the browser's sandbox environment by leveraging a specially crafted HTML page. This vulnerability represents a severe security risk as it bypasses core browser isolation protections, potentially granting an attacker full control over the compromised system. The defect resides in the lifecycle management of objects within the Views UI framework, which is responsible for rendering browser elements. Exploitation requires no specific user authentication or elevated privileges, provided the user navigates to a malicious webpage. Given the potential for sandbox escape and subsequent system-level compromise, this vulnerability is classified as critical. Organizations and users are strongly advised to update to version 152.0.7977.65 or later to mitigate the risk of remote code execution.",
  "technicalDetails": "The vulnerability is a memory corruption flaw specifically categorized as a Use-After-Free (UAF) residing in the Views UI framework of Google Chrome. In the context of browser architecture, Views is a C++ UI toolkit used to implement browser windows, dialogs, and other interface components. The issue occurs when the browser's memory management logic fails to properly synchronize the lifecycle of a Views-based object, resulting in a dangling pointer.\nThe attack flow initiates when a remote attacker delivers a crafted HTML page to a victim. Upon rendering this page, the browser's JavaScript engine or the layout engine interacts with the vulnerable UI component. Through heap grooming or specific DOM manipulations, the attacker induces a state where a heap-allocated object is freed prematurely while a reference to that memory location remains active within the Views component. Subsequent access to this dangling pointer allows for a re-use of the memory location with attacker-controlled data.\nBy controlling the contents of the freed memory, the attacker can manipulate internal object structures—such as virtual method tables (vtable pointers) or function pointers—stored within the affected memory block. When the application logic attempts to trigger a member function on the freed object, it redirects execution flow to a malicious payload provided by the attacker. Because the vulnerability involves the Views component, which operates with higher privileges than the web-content rendering process, the exploitation facilitates a sandbox escape.\nThe impact of this successful exploitation is the execution of arbitrary code in the context of the user process. This effectively bypasses the Chromium sandbox, enabling the attacker to perform actions outside the restrictive environment of the renderer process. The flaw affects versions of Google Chrome on macOS prior to 152.0.7977.65. There are no authentication requirements for an attacker; the vulnerability is triggered via standard network exposure where the victim navigates to an adversary-controlled URL. Once code execution is achieved, the attacker may perform post-exploitation activities, including sensitive data exfiltration, persistent malware installation, or pivoting into the local operating system environment."
}