Description

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:13.490Z",
  "pubdate": "2026-08-25T21:18:13.490Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability has been identified within the V8 JavaScript engine of Google Chrome. This memory corruption flaw allows a remote attacker to achieve arbitrary code execution within the constrained environment of the browser's sandbox. The vulnerability affects Google Chrome versions prior to 152.0.7977.65. Exploitation is facilitated through a specially crafted HTML page, which, when rendered by a vulnerable browser, triggers the UAF condition. While the Chromium project currently assigns this a severity rating of 'Low', the potential for arbitrary code execution poses a significant risk to user integrity and system security. The flaw highlights a memory management failure during object lifecycle handling, allowing an attacker to manipulate heap-resident data after it has been deallocated. Successful exploitation requires user interaction, typically involving navigating a user to a malicious webpage, where the attacker can leverage the UAF to potentially bypass sandbox protections or gain primitive control over the execution flow of the renderer process.",
  "technicalDetails": "The root cause of this vulnerability lies in the V8 engine's garbage collection and memory management subsystem. A use-after-free condition occurs when a pointer to a heap-allocated object is retained after the object has been formally deallocated or garbage collected. In the context of V8, this typically involves complex object life-cycle management, such as the interaction between JavaScript objects and the underlying C++ implementation classes, or during JIT (Just-In-Time) compilation and optimization phases.\nWhen a malicious HTML page is parsed by the affected version of Google Chrome, the attacker can influence the state of the heap by forcing the engine to allocate and subsequently free specific object types. By triggering a race condition or manipulating the timing of the garbage collector, the attacker ensures that a 'dangling pointer' persists in the system. The attacker then populates the freed memory location with controlled data, often referred to as 'heap spraying' or 'heap grooming'.\nOnce the dangling pointer is utilized to access the newly placed, attacker-controlled data, the V8 engine inadvertently treats the malicious input as a legitimate internal object or function pointer. This invalid access provides the attacker with a powerful primitive, such as arbitrary read/write capabilities within the renderer process memory space. By overwriting function pointers or object vtables, the attacker can redirect the program's execution flow to arbitrary code (e.g., a ROP chain or shellcode) injected into the heap.\nBecause this occurs inside the sandbox, the initial impact is restricted to the renderer process. However, the ability to execute arbitrary code within the sandbox is a critical stage in a multi-stage exploit chain. An attacker could potentially combine this vulnerability with a secondary flaw in the browser's IPC (Inter-Process Communication) layer or the underlying OS kernel to break out of the sandbox and gain elevated privileges on the host system. The vulnerability is triggered remotely without requiring authentication, and the scope of the impact is defined by the security boundary of the Chrome renderer process. The failure to properly nullify references after free operations in the affected V8 components allows for this type of memory corruption, which is a hallmark of sophisticated browser exploitation strategies."
}