Description

Use after free in Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:13.603Z",
  "pubdate": "2026-08-25T21:18:13.603Z",
  "executiveSummary": "A critical Use-After-Free (UAF) memory corruption vulnerability exists within the Platform component of Google Chrome.\nThis vulnerability allows a remote, unauthenticated attacker to execute arbitrary code within the confines of the browser's sandbox environment.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65.\nSuccessful exploitation requires the victim to interact with a specially crafted HTML page, typically via navigation or redirection.\nGiven the nature of UAF vulnerabilities, this issue poses a high risk to user data integrity and system security, as it provides a vector for full remote code execution within the renderer process.\nThe vulnerability highlights a critical failure in memory management, where the browser attempts to access an object memory address after its associated memory has been deallocated.\nThe impact is significant, as sandbox escape mechanisms or further chainable vulnerabilities could potentially lead to a complete system compromise beyond the renderer's restricted execution context.",
  "technicalDetails": "The vulnerability is rooted in a Use-After-Free (UAF) condition within the Platform component of the Chromium architecture. A UAF occurs when a program continues to utilize a pointer to a memory location after that memory has been freed or reallocated. In the context of Google Chrome, this typically involves a complex object life-cycle management error within the browser's document object model (DOM) implementation or related rendering engine components.\nExploitation initiates when a remote attacker hosts a malicious HTML page containing crafted payloads, such as specific JavaScript sequences designed to manipulate object lifetimes. When the victim accesses this page, the browser's rendering engine processes the malicious constructs, triggering an improper state transition. If an object is freed due to an asynchronous event or an unexpected DOM mutation, but a reference to that object is retained by the rendering logic, the subsequent interaction with this dangling pointer results in a UAF state.\nThe attack flow proceeds as follows: 1) The attacker lures the user to a crafted web page. 2) The page executes code that forces a specific object to be deallocated while retaining a pointer to its address. 3) The attacker utilizes a heap spray or similar memory grooming technique to allocate controlled data at the same memory address previously occupied by the freed object. 4) The browser, attempting to perform an operation on the 'dangling' pointer, inadvertently executes the attacker's supplied data instead of the legitimate object's virtual function table (vtable) or data members. This control flow hijacking allows the attacker to redirect execution to malicious shellcode or a ROP chain.\nThis vulnerability is restricted to the browser's sandbox, meaning the immediate execution occurs within the low-privilege renderer process. However, the high severity rating reflects the potential for this primitive to be chained with other vulnerabilities (such as sandbox escapes) to achieve arbitrary code execution at the operating system level. The flaw does not require prior authentication and can be exploited over a network, making it a highly effective vector for drive-by download attacks targeting end-users on unpatched software versions."
}