Description

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:17.413Z",
  "pubdate": "2026-08-25T21:18:17.413Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Aura window management system of Google Chrome, affecting versions prior to 152.0.7977.65. This memory corruption flaw allows a remote attacker to execute arbitrary code outside the browser's sandbox environment.\nThe vulnerability occurs due to improper memory lifecycle management within the Aura framework, where a heap-allocated object is accessed after it has been deallocated. Successful exploitation enables a remote threat actor to manipulate the heap, leading to arbitrary code execution, potential system compromise, and bypass of browser security boundaries.\nGiven the nature of the vulnerability, exploitation requires only that a user navigates to a specifically crafted HTML page. The impact is considered high, as it grants attackers the ability to achieve execution beyond the restricted sandbox, posing a severe risk to end-user systems.",
  "technicalDetails": "The vulnerability resides in the Aura UI component within Chromium. A Use-After-Free (UAF) condition is triggered when an object associated with the Aura UI framework is prematurely freed while a dangling pointer remains active in the application memory space.\nExploitation involves an attacker hosting a malicious HTML page that interacts with the browser's rendering engine to manipulate the object's lifecycle. By triggering specific events, the attacker causes the browser to free the memory associated with an Aura object. Subsequently, the attacker employs heap grooming techniques to occupy the freed memory slot with controlled data, such as a faked vtable or object structure.\nWhen the browser attempts to access the original pointer to perform operations, it instead references the attacker-controlled memory. This redirection allows for the hijacking of the execution flow. If the attacker successfully redirects control to a payload within the process context, they can bypass the Chromium sandbox mechanism.\nThe attack flow typically follows these steps: 1) The attacker constructs a document designed to trigger the specific UAF memory state within the Aura component. 2) The victim browses to the malicious site, invoking the vulnerable code path. 3) The memory corruption occurs, allowing for heap manipulation. 4) The attacker gains control over a pointer or a virtual function call, facilitating arbitrary code execution.\nThis vulnerability highlights a critical breakdown in memory safety within the UI handling stack. Because the vulnerability allows for execution outside the sandbox, the browser's primary mitigation against remote exploits is rendered ineffective. The absence of proper reference counting or nullification of pointers upon object deallocation allows the application to continue using stale memory references, which is a common but dangerous pattern in complex C++ rendering engines.\nThe exploitation does not require pre-existing authentication or local system privileges, making it highly attractive for web-based attacks against arbitrary targets. Post-exploitation, an attacker may escalate their persistence, exfiltrate sensitive data, or install secondary payloads on the host operating system, effectively negating the isolation provided by the Chromium sandbox."
}