Description

Use after free in Accessibility in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:11.927Z",
  "pubdate": "2026-08-25T21:18:11.927Z",
  "executiveSummary": "A high-severity use-after-free (UAF) vulnerability exists within the Accessibility component of Google Chrome prior to version 152.0.7977.65.\nThe flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox environment.\nExploitation requires the attacker to employ social engineering techniques to induce specific UI interactions from a user.\nSuccessful exploitation compromises the integrity and confidentiality of the host system, as the execution occurs outside the restricted sandbox boundaries.\nThis vulnerability highlights a critical breakdown in memory management protocols within the browser's accessibility services, presenting significant risk to end-users who may be tricked into interacting with malicious interface elements.\nThe requirement for social engineering suggests that the attack vector is likely initiated via web-based content that requires user engagement to trigger the vulnerable code path.",
  "technicalDetails": "The vulnerability is a use-after-free (UAF) condition located within the Accessibility subsystem of the Chromium engine. A use-after-free occurs when an application continues to use a pointer after the memory area it points to has been deallocated or freed, typically leading to undefined behavior, memory corruption, or controlled execution flow manipulation.\nIn this specific instance, the Accessibility component fails to properly manage the lifecycle of objects related to UI elements. When a user interacts with a specially crafted web interface—facilitated by social engineering—a sequence of events is triggered that frees an accessibility object while a reference to that object remains active within the browser's memory management system.\nThe exploitation flow initiates when an attacker presents a deceptive UI element to the user. Upon interaction, the browser's internal accessibility tree attempts to reference the already-freed memory location. Because the memory may have been reallocated for different purposes by the heap manager after the initial free, the attacker can potentially groom the heap to place controlled data into the now-reallocated memory slot.\nBy manipulating the heap layout, an attacker can influence the state of the object, subsequently redirecting the application's control flow. Because the vulnerability manifests within a context that facilitates arbitrary code execution outside the sandbox, the attacker effectively bypasses the primary security boundary of Google Chrome. This suggests that the vulnerable code runs with higher privileges or in a process context that is not sufficiently isolated from the underlying operating system.\nThe vulnerability affects all versions of Google Chrome prior to 152.0.7977.65. The lack of proper synchronization and object lifetime verification during UI interaction events is the primary driver of this flaw. Once the arbitrary code execution is achieved, the attacker can leverage the host's privilege level to install malware, exfiltrate sensitive data, or establish persistent control over the victim's machine. The attack is remote, requiring only that the victim visit a malicious URL and follow the attacker's prompts to engage with the UI."
}