Description

Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:12.380Z",
  "pubdate": "2026-08-25T21:18:12.380Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the WebRTC component of Google Chrome prior to version 152.0.7977.65.\nThis vulnerability allows a remote attacker to achieve arbitrary code execution within the confines of the browser sandbox by enticing a user to navigate to a specifically crafted HTML page.\nClassified as a high-severity security flaw, this issue stems from improper memory management within the WebRTC stack, potentially leading to heap corruption.\nThe attack is executed remotely, requiring no authentication or elevated privileges from the victim, making it a significant risk for browser-based exploitation.\nSuccessful exploitation compromises the integrity and confidentiality of the browser session and could serve as a vector for further sandbox escape attempts.",
  "technicalDetails": "The vulnerability is a classic Use-After-Free (UAF) flaw residing in the WebRTC implementation within the Chromium codebase. UAF vulnerabilities occur when an application continues to utilize a pointer to a memory location after that memory has been deallocated or freed.\nIn this context, the WebRTC component fails to properly manage the lifecycle of objects during specific call signaling or media stream processing states. When an object is prematurely freed while a reference to it remains active within the browser's execution context, a 'dangling pointer' is created.\nThe attack flow begins when an attacker hosts a malicious HTML page containing specifically crafted JavaScript intended to manipulate WebRTC state transitions. When a victim accesses this page, the JavaScript triggers a series of WebRTC API calls designed to force the premature deallocation of a targeted object while keeping a reference to it alive in a secondary thread or task queue.\nOnce the memory has been freed, the attacker utilizes heap grooming techniques—such as spraying the heap with controlled data—to occupy the deallocated memory region with a malicious payload. When the WebRTC component subsequently attempts to access the object via the stale dangling pointer, it inadvertently executes the attacker-controlled data.\nBecause the execution occurs within the context of the renderer process, the attacker is initially confined by the browser's sandbox. However, the ability to execute arbitrary code provides a foothold that can be leveraged to bypass security controls, facilitate memory leaks to calculate ASLR base addresses, or prepare the environment for a sandbox escape exploit.\nThis vulnerability affects Google Chrome versions prior to 152.0.7977.65. The exploit is entirely remote, requires no user interaction beyond visiting the malicious webpage, and operates without requiring prior authentication. The root cause is categorized as an improper implementation of object reference counting or object lifecycle management within the Chromium media pipeline."
}