Description

Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:11.040Z",
  "pubdate": "2026-08-25T21:18:11.040Z",
  "executiveSummary": "This vulnerability involves a type confusion flaw within the Accessibility component of Google Chrome on Windows.\nA remote attacker who has already compromised the renderer process can exploit this vulnerability to achieve arbitrary code execution outside the browser sandbox.\nThe vulnerability is rated as High severity, posing a significant risk to user data and system integrity if the renderer process is successfully breached.\nSuccessful exploitation requires the attacker to gain initial execution in the renderer process, typically via a crafted HTML page, followed by leveraging the type confusion to escape the sandboxed environment.\nThe flaw affects versions of Google Chrome on Windows prior to 152.0.7977.65.",
  "technicalDetails": "The vulnerability originates from a type confusion flaw located in the Accessibility subsystem of the Chromium engine. Type confusion occurs when the program attempts to access a resource (such as an object or memory address) using a type that is incompatible with the resource's actual type. In this instance, the internal logic within the accessibility handling routines fails to validate the underlying type of an object, leading to an incorrect interpretation of data structures.\nThe exploitation flow begins with the attacker compromising the browser's renderer process. This is often achieved through a secondary exploit, such as a memory corruption vulnerability in the browser's JavaScript engine, which allows the attacker to execute arbitrary code within the restricted renderer sandbox. Once control over the renderer process is established, the attacker delivers a specially crafted HTML page designed to trigger the specific accessibility code path containing the type confusion.\nBy manipulating the accessibility tree or associated metadata, the attacker induces the application to treat a generic object as a more specific type with different properties or memory layouts. This allows for an out-of-bounds memory read or write, which can be leveraged to corrupt pointers or bypass security mechanisms such as Address Space Layout Randomization (ASLR).\nGiven that the vulnerability exists within the Accessibility component, it enables the attacker to manipulate sensitive data structures that interact with the Windows OS environment. By successfully hijacking the control flow through the manipulated object, the attacker can break out of the renderer sandbox. This transition from the sandboxed renderer process to the higher-privileged browser process or directly to the host operating system constitutes a sandbox escape.\nThe payload delivered via the crafted HTML page essentially serves to groom the heap and establish the type confusion state, which then executes the attacker's arbitrary code. Once the sandbox is escaped, the attacker gains the execution privileges of the browser application itself on the Windows host, potentially leading to unauthorized data access, system persistence, or lateral movement within the network.\nAffected versions of Google Chrome on Windows are those identified as prior to 152.0.7977.65. The vulnerability does not require authentication but does rely on the victim navigating to the malicious content to initiate the renderer process compromise."
}