Description

Race condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:10.713Z",
  "pubdate": "2026-08-25T21:18:10.713Z",
  "executiveSummary": "A critical race condition vulnerability exists within the FileSystem component of Google Chrome prior to version 152.0.7977.65. This security flaw allows a remote attacker who has already achieved compromise of the browser's renderer process to escalate privileges and execute arbitrary code outside the established security sandbox.\nThe vulnerability involves improper synchronization within the FileSystem handling logic, which can be manipulated to trigger memory corruption or logic errors that bypass kernel-level or process-level protections. By leveraging a specially crafted HTML page, an attacker can coerce the renderer process into performing unauthorized operations.\nGiven that this vulnerability facilitates sandbox escape, it represents a High-severity risk to system integrity and confidentiality. Successful exploitation grants the attacker the ability to execute code with the permissions of the browser process, effectively negating the foundational security isolation provided by the Chromium sandbox architecture. There are no authentication requirements for this exploit, provided the attacker can direct a target to a malicious URL, making it a significant threat for web-based attacks.",
  "technicalDetails": "The vulnerability originates from a race condition located within the FileSystem API implementation in Chromium. Race conditions in browser engines typically occur when multiple threads access shared memory or file descriptors without sufficient locking mechanisms, leading to Time-of-Check to Time-of-Use (TOCTOU) bugs or use-after-free scenarios.\nIn this instance, the flaw resides in the communication interface between the renderer process and the privileged browser process. The renderer process, which operates in a restricted environment, relies on the browser process to execute sensitive FileSystem I/O operations via Mojo interfaces. The race condition allows an attacker to manipulate the state of a file handle or directory entry between the validation check performed by the browser process and the subsequent execution of the file operation.\nThe attack flow begins with the attacker compromising the renderer process, likely through a separate memory corruption vulnerability in the JavaScript engine or layout engine. Once execution is gained within the renderer, the attacker initiates a series of asynchronous FileSystem API calls designed to stress the synchronization primitives of the underlying component. By flooding the FileSystem service with overlapping requests, the attacker induces a race condition where the internal state of the FileSystem object becomes inconsistent.\nExploitation involves winning this race to trick the browser process into performing an unintended operation, such as file access or modification, outside of the permitted sandbox boundaries. Because the browser process typically runs with elevated privileges compared to the renderer, this breach of the sandbox boundary results in arbitrary code execution on the host machine. The payload behavior involves executing a shellcode or secondary exploit module that escapes the renderer's constraints, effectively granting the attacker persistence or control over the user's host environment.\nThis vulnerability is particularly dangerous because it bypasses the primary security mitigation of Chrome: the site isolation and process sandbox. Since the vulnerability is located in the shared FileSystem service, it exposes a critical attack surface that the renderer process interacts with regularly. Affected versions include all iterations of Google Chrome prior to 152.0.7977.65. No authentication is required to trigger the vulnerability, as it is exploitable via a malicious HTML page rendered by the browser."
}