Description

Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:19.107Z",
  "pubdate": "2026-08-25T21:18:19.107Z",
  "executiveSummary": "A critical security vulnerability identified as a Use-After-Free (UAF) flaw exists within the Chromoting component of Google Chrome on Windows.\nThis vulnerability allows a remote attacker, who has already achieved an initial compromise of the renderer process, to perform a sandbox escape and achieve arbitrary code execution on the host operating system.\nThe flaw stems from improper memory management during the processing of crafted network traffic by the Chromoting infrastructure.\nThe impact of this vulnerability is severe, as it facilitates a transition from a sandboxed environment to full system-level compromise.\nExploitation requires the attacker to successfully target the renderer process first, after which the malicious payload is delivered via network communication to trigger the UAF condition.\nUsers on versions of Google Chrome prior to 152.0.7977.65 are at risk and are advised to update their browser to mitigate potential remote exploitation.",
  "technicalDetails": "The vulnerability is classified as a Use-After-Free condition residing within the Chromoting module, which provides remote desktop functionality within the Chromium framework.\nIn the Chromium architecture, the renderer process is strictly isolated via a sandbox to prevent unauthorized access to the underlying operating system. However, this UAF vulnerability provides a mechanism to bypass these security boundaries.\nThe root cause of the vulnerability involves an object in the Chromoting component being freed while a dangling pointer to that memory location remains active. If the application subsequently attempts to interact with this dangling pointer, it can lead to memory corruption.\nThe attack flow initiates with the compromise of the renderer process. Once the attacker controls the renderer context, they deliver specially crafted network traffic intended for the Chromoting service.\nWhen the Chromoting component processes this malicious traffic, it triggers the UAF state. By controlling the contents of the memory that is reallocated into the freed slot, the attacker can manipulate internal structures, such as vtable pointers or function pointers.\nBy overwriting these pointers with the addresses of attacker-controlled code or ROP (Return-Oriented Programming) gadgets, the attacker redirects the execution flow of the process outside of the intended sandbox constraints.\nBecause the Chromoting module often operates with elevated privileges compared to the renderer process, achieving code execution here allows the attacker to break out of the sandbox and execute arbitrary commands with the privileges of the Chrome process on the Windows host.\nThis attack vector requires the attacker to have sufficient control over the renderer process to inject or influence the network traffic handled by the Chromoting stack. No specific user interaction is required once the renderer process is compromised if the service is actively reachable via the network.\nThe vulnerability is specifically constrained to Google Chrome on Windows versions prior to 152.0.7977.65."
}