Description

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:13.827Z",
  "pubdate": "2026-08-25T21:18:13.827Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the Aura UI component of Google Chrome prior to version 152.0.7977.65. The flaw permits a remote, unauthenticated attacker to execute arbitrary code on the host system.\nThe vulnerability resides in the memory management logic of the Aura framework. By leveraging a specially crafted HTML page, an attacker can trigger a state where memory is accessed after it has been deallocated, leading to heap corruption.\nThis vulnerability is classified as critical because it allows for code execution outside the browser's security sandbox, effectively bypassing primary browser isolation mechanisms. This poses a significant risk to user data integrity, confidentiality, and system stability. Successful exploitation grants the attacker the ability to execute commands with the privileges of the logged-in user, potentially leading to full system compromise.\nThe vulnerability does not require user authentication or elevated privileges, relying solely on a victim visiting a malicious webpage. Given the nature of use-after-free bugs, this is a prime candidate for remote code execution (RCE) chains, making rapid patching essential for all environments utilizing the affected Chrome versions.",
  "technicalDetails": "The vulnerability is identified as a use-after-free (UAF) condition within the Aura UI stack, which is the window management and graphics toolkit used by Chromium. A UAF occurs when an application continues to use a pointer to a memory location after that memory has been freed. In the context of Chrome's Aura implementation, the bug likely arises from improper reference counting or premature destruction of window objects or event-handling structures during page rendering.\nThe exploitation flow typically begins when a victim navigates to a malicious URL containing a crafted HTML document. The document uses DOM manipulation or specific rendering patterns to induce a state where an object, such as an Aura window or sub-component, is deleted while an active reference to it remains in the script engine's context or the browser's internal task queue. If the attacker can control the contents of the freed heap memory (a technique known as heap spraying or heap grooming), they can replace the original object with controlled data.\nWhen the browser subsequently attempts to access the freed object, it operates on memory now controlled by the attacker. This can be weaponized to overwrite virtual function tables (vtable pointers) or modify function pointers within the object structure. By diverting the control flow to attacker-supplied shellcode or utilizing Return-Oriented Programming (ROP) gadgets, the attacker executes arbitrary instructions.\nBecause the vulnerability exists in a way that allows the attacker to break out of the browser's sandbox, the exploit likely involves chaining the initial UAF with secondary vulnerabilities to bypass OS-level protections like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). The lack of memory safety in the underlying C++ code base of Aura makes it susceptible to these lifecycle management errors. Once sandbox escape is achieved, the payload behavior is unrestricted by the browser's security boundary, allowing the attacker to interact with the underlying operating system, install persistent malware, exfiltrate sensitive files, or pivot to other network segments.\nThe vulnerability affects Chromium-based browsers running Aura prior to version 152.0.7977.65. It is triggered remotely through web content and requires no user interaction beyond the initial page navigation. The primary risk is the bypass of the sandbox, which is the most critical security layer protecting the operating system from malicious web-based exploitation."
}