Description

Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:18:13.140Z",
  "pubdate": "2026-08-25T21:18:13.140Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) memory corruption flaw identified within the Chromoting component of Google Chrome on Windows.\nThe vulnerability carries a High security severity rating, as it allows a remote attacker to execute arbitrary code outside the browser's security sandbox environment.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65.\nSuccessful exploitation requires the victim to process specifically crafted network traffic facilitated by the attacker.\nThe primary risk implication is a total compromise of the host system, as the ability to break out of the sandbox bypasses the core security architecture designed to prevent malicious code from accessing the underlying operating system.\nAttackers can leverage this vulnerability to gain unauthorized control, facilitate persistent access, or exfiltrate sensitive data from the host machine without requiring prior authentication.",
  "technicalDetails": "The vulnerability resides in the Chromoting component, which handles remote desktop connectivity within the Chromium ecosystem. The root cause is a Use-After-Free condition where the application fails to properly manage the lifecycle of a memory object, leading to a dangling pointer.\nIn a Use-After-Free scenario, an object is freed from memory, but a reference to that memory address persists. If an attacker can trigger the reuse of this memory location before the original reference is invalidated or reassigned, they can induce the application to perform operations on attacker-controlled data instead of the intended object.\nThe exploitation flow begins with the delivery of crafted network traffic to the Chromoting component. By carefully manipulating the incoming data stream, the attacker influences the internal state of the component, specifically targeting the memory management logic associated with object lifecycle transitions.\nThe attacker initiates the vulnerability by triggering a sequence of events that causes the application to free a resource prematurely. Subsequently, the attacker fills the freed memory space with malicious payload content. When the application subsequently attempts to access the stale pointer, it inadvertently executes the attacker-supplied data as if it were legitimate code or data structures.\nBecause the vulnerability occurs within the Chromoting context, which often requires higher system privileges or access to specific system APIs, successful exploitation allows the attacker to escape the restricted Chromium sandbox. Escaping the sandbox is critical because it grants the attacker the ability to interact directly with the Windows kernel or other elevated system services, effectively bypassing the browser's primary defense-in-depth mechanisms.\nThe impact of this exploit is severe, as it facilitates arbitrary code execution with the permissions of the Chromoting process. Given that remote access components frequently require elevated privileges to function, this often results in full system compromise. Post-exploitation activities may include the deployment of malware, installation of backdoors for persistent access, or direct theft of user credentials and sensitive files residing on the host workstation.\nThis vulnerability is categorized as a remote exploit, requiring no local user interaction beyond the initial processing of the malicious network traffic initiated by the attacker. All versions of Google Chrome on Windows prior to 152.0.7977.65 are susceptible to this memory management failure."
}