Description

Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:16.417Z",
  "pubdate": "2026-08-25T21:18:16.417Z",
  "executiveSummary": "This vulnerability is an integer overflow flaw identified within the Chromium project, which impacts Google Chrome versions prior to 152.0.7977.65.\nThe vulnerability allows a remote, unauthenticated attacker to execute a memory read operation within the context of the Chromium sandbox.\nBy leveraging a specially crafted file, an attacker can bypass standard security boundaries to access sensitive information residing in memory.\nAlthough categorized as Low severity, the capability to perform out-of-bounds memory reads presents a significant risk for information disclosure, potentially exposing cryptographic keys, user data, or memory pointers that could facilitate more complex exploit chains.\nThe vulnerability does not require user authentication but necessitates the victim to interact with a malicious file to trigger the overflow condition.\nEffective risk management requires ensuring that browser installations are updated to the specified patched version to neutralize this vector.",
  "technicalDetails": "The root cause of this vulnerability is an integer overflow occurring during the processing of a maliciously crafted file within the Chromium rendering or processing engine.\nAn integer overflow occurs when an arithmetic operation attempts to create a numeric value that exceeds the maximum storage capacity of the integer type used in the source code. In the context of memory management and buffer handling, this overflow typically results in an incorrect size calculation for memory allocation or indexing.\nWhen the affected component processes the crafted input, the integer overflow causes the application to allocate an insufficient buffer or perform an invalid offset calculation. This flaw facilitates an out-of-bounds read operation, wherein the application reads data from memory addresses outside the intended boundaries of the allocated buffer.\nThe attack flow begins when an attacker delivers a malicious file to a target user. Once the user opens or interacts with this file via the vulnerable browser, the Chromium engine parses the file. During parsing, the logic responsible for handling the specific file format triggers the integer overflow.\nBy manipulating the file content, an attacker can control the input variables used in the overflow, effectively redirecting the read pointer to arbitrary locations within the sandbox's memory space.\nBecause this operation occurs within the sandbox, the attacker is limited to the memory space accessible to the specific renderer process; however, this is sufficient to exfiltrate sensitive data such as document structures, heap-allocated objects, or other data processed by the browser at that time.\nSuccessful exploitation bypasses standard memory protection mechanisms by leveraging the browser's own internal logic flaws. No prior authentication is required, as the vulnerability is inherent to the parsing logic of the file format itself. Post-exploitation, the attacker may utilize the leaked information to facilitate more advanced attacks, such as identifying memory layouts to bypass Address Space Layout Randomization (ASLR) in subsequent remote code execution attempts."
}