Description

Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:17.747Z",
  "pubdate": "2026-08-25T21:18:17.747Z",
  "executiveSummary": "A critical use-after-free vulnerability exists within the WebGL implementation of Google Chrome, specifically affecting versions prior to 152.0.7977.65.\nThe vulnerability allows a remote attacker to execute arbitrary code outside the browser sandbox environment by leveraging a maliciously crafted HTML page.\nThis flaw involves improper memory management within the WebGL component, which can lead to memory corruption when specific sequences of operations are performed on reclaimed memory segments.\nGiven the nature of the exploit, it poses a High severity risk, enabling potential full system compromise if chained with secondary exploits or if the sandbox is successfully bypassed.\nThe attack is remotely exploitable without requiring user authentication, relying solely on the victim visiting a compromised webpage.\nSuccessful exploitation allows attackers to execute native code on the host operating system, bypassing the security boundaries established by the Chromium sandbox.",
  "technicalDetails": "The vulnerability is identified as a use-after-free (UAF) condition within the WebGL graphics processing subsystem of Google Chrome. UAF vulnerabilities typically occur when a program continues to utilize a pointer to a memory location after that memory has been freed or deallocated.\nIn the context of the Chromium rendering engine, this issue likely involves the management of WebGL resources such as buffers, textures, or framebuffers. If the state machine managing these objects does not correctly synchronize resource deallocation with ongoing rendering tasks or asynchronous events, a dangling pointer may be left in the system state.\nThe attack flow begins when an attacker directs a user to a specially crafted HTML page containing malicious JavaScript code utilizing the WebGL API. By inducing specific lifecycle transitions for WebGL objects, the attacker forces the browser to free a resource that remains referenced by other internal components.\nOnce the memory has been freed, the attacker may perform heap grooming techniques—such as spraying objects of a similar size—to reallocate the memory formerly occupied by the WebGL resource. By filling this 'hole' with attacker-controlled data, the dangling pointer is repurposed to point to memory containing malicious payloads or controlled function pointers.\nWhen the browser subsequently attempts to access the resource via the dangling pointer, it effectively operates on the data supplied by the attacker. This enables the redirection of execution flow, eventually facilitating arbitrary code execution.\nBecause the vulnerability occurs within the WebGL context, the exploit must overcome the Chromium sandbox protections. By achieving code execution, the attacker aims to escalate privileges or move laterally into the host environment, bypassing the intended isolation between the browser process and the operating system.\nAffected versions include all iterations of Google Chrome prior to 152.0.7977.65. The vulnerability requires no interaction beyond navigating to the malicious origin, and the lack of authentication makes this a significant vector for drive-by download attacks."
}