Description

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:13.250Z",
  "pubdate": "2026-08-25T21:18:13.250Z",
  "executiveSummary": "A high-severity Use-After-Free (UAF) vulnerability exists within the Script component of Google Chrome, specifically affecting versions prior to 152.0.7977.65. This memory corruption flaw originates from improper lifecycle management of objects within the browser's scripting engine. A remote attacker can weaponize this vulnerability by enticing a user to navigate to a specifically crafted HTML page designed to trigger the invalid memory access.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary code within the confines of the renderer sandbox. By leveraging the UAF condition to achieve memory corruption, the attacker can hijack control flow, potentially leading to unauthorized operations or deeper sandbox escape scenarios. Given the nature of Chromium's architecture, this vulnerability poses a critical threat to user confidentiality and system integrity. Users are strongly advised to update to version 152.0.7977.65 or later to mitigate these risks.",
  "technicalDetails": "The vulnerability is a classic Use-After-Free (UAF) memory corruption bug located within the Script processing subsystem of the Chromium browser. A UAF occurs when an application continues to utilize a memory pointer after the associated object has been deallocated or freed. In this instance, the flaw involves a race condition or a lifecycle mismanagement issue where the Script engine retains a reference to a memory address that has already been returned to the heap allocator.\nThe attack flow begins when a remote attacker delivers a crafted HTML payload to a target user. This payload typically utilizes complex Document Object Model (DOM) manipulations or JavaScript execution sequences designed to cause the browser to free a specific memory object while keeping an active pointer (dangling pointer) to that memory location. Once the object is freed, the attacker may perform 'heap spraying' or other heap grooming techniques to reallocate the freed memory block with malicious data—often containing forged objects, pointers, or shellcode patterns.\nWhen the Script engine subsequently attempts to access the dangling pointer, it inadvertently operates on the attacker-controlled memory. If the application attempts to invoke a virtual method or perform an operation based on the data now residing at that location, the execution flow is redirected to an attacker-controlled address. This effectively facilitates arbitrary code execution within the renderer process context.\nBecause this execution occurs within the renderer process, the attacker is initially restricted by the browser's sandbox environment. However, once arbitrary code execution is achieved in the renderer, the attacker can attempt to exploit subsequent vulnerabilities in the IPC (Inter-Process Communication) layer or kernel-level interfaces to escape the sandbox and achieve full system compromise. The vulnerability does not require authentication and is reachable remotely through standard web interaction, making it highly dangerous for users navigating to compromised or malicious sites."
}