Description

Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:14.820Z",
  "pubdate": "2026-08-25T21:18:14.820Z",
  "executiveSummary": "A type confusion vulnerability exists within the Animation component of Google Chrome, specifically affecting versions prior to 152.0.7977.65. The vulnerability arises from improper handling of object types during animation processing, which can be triggered by a maliciously crafted HTML page.\nSuccessful exploitation of this flaw allows a remote attacker to execute arbitrary code within the context of the browser's sandbox. Given the nature of type confusion, this could lead to memory corruption, potentially bypassing security controls to gain unauthorized execution capabilities.\nThe vulnerability is rated as having a Medium severity, likely due to the sandbox constraint, which mitigates the direct impact on the underlying host operating system. However, it represents a significant risk for users visiting untrusted or compromised web pages, as the exploitation does not require user authentication.\nThe primary risk implication involves the compromise of the renderer process, which could serve as a primitive for further attacks aimed at escaping the sandbox or exfiltrating sensitive browser-stored data. Organizations and end-users are advised to prioritize updating to the patched version of the browser to remediate the flaw.",
  "technicalDetails": "The vulnerability is rooted in a type confusion error within the browser's animation engine. Type confusion occurs when a program allocates or initializes a resource—such as an object or pointer—using one type but subsequently accesses it using an incompatible type. In the context of Chrome's Animation component, the engine fails to correctly validate the internal type of an object during an animation sequence.\nThe attack flow begins when a remote attacker delivers a specifically crafted HTML document to a victim. This document contains embedded scripts or CSS transitions that leverage the Animation component to trigger the flawed code path. When the browser's rendering engine processes these animations, the underlying C++ logic incorrectly assumes the memory layout of an object, leading to a type mismatch.\nUpon triggering this confusion, an attacker can manipulate the internal state of the affected object. If the object contains function pointers or virtual method tables (vtable), the confusion allows the attacker to redirect the execution flow to arbitrary memory addresses. Since the vulnerability occurs within the renderer process, the resulting execution of arbitrary code is constrained by the Chrome sandbox.\nExploitation involves several key steps: first, the attacker must achieve memory corruption to gain a 'read/write' primitive or control flow hijack. By manipulating the object's fields through the Animation interface, the attacker forces the engine to treat malicious data as a legitimate object structure. This bypasses typical type-safety checks enforced by the language or the browser engine.\nWhile the sandbox prevents direct interaction with the host operating system, it does not prevent the attacker from executing JavaScript or native code within the renderer process. This allows for the exfiltration of cookies, session tokens, or other sensitive data residing in the renderer's memory. Furthermore, this exploit is often used as a critical component in multi-stage chains where a second vulnerability is used to achieve a sandbox escape, ultimately leading to full system compromise.\nThe affected component is the Animation engine within the Chromium codebase. The vulnerability is present in versions of Google Chrome preceding 152.0.7977.65. There are no authentication requirements for an attacker to reach this code path, as the processing of HTML, CSS, and animation properties occurs automatically upon page rendering, making this a zero-click exploit vector for web-based attacks."
}