Description

Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted file. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:19.323Z",
  "pubdate": "2026-08-25T21:18:19.323Z",
  "executiveSummary": "A code injection vulnerability exists within the Bisection component of Google Chrome prior to version 152.0.7977.65.\nThis vulnerability allows a remote attacker to achieve unauthorized access to sensitive information by leveraging a specially crafted file.\nThe flaw is classified with a Medium severity rating by the Chromium security team.\nThe vulnerability occurs due to improper handling of inputs within the Bisection process, which is typically used for regression testing and identifying the specific commit that introduced a bug.\nBy manipulating the environment or the file processed by the Bisection tool, an attacker can trigger a code injection scenario.\nSuccessful exploitation results in the exposure of sensitive data, potentially compromising the user's local environment or browser-managed secrets.\nThe attack is characterized as remote, meaning no local physical access is required, although it necessitates the user interacting with a malicious file.\nMitigation requires updating the Google Chrome browser to the specified version or later to receive the necessary security patches addressing the injection vector.",
  "technicalDetails": "The vulnerability resides in the Bisection utility component within the Chromium codebase, which is utilized for automated binary search processes to isolate problematic code commits. The root cause is identified as an insufficient validation mechanism when processing input files during the Bisection execution flow.\nUnder normal operating conditions, the Bisection tool expects structured data to determine the progression of build states. The vulnerability manifests when a crafted file—containing malicious payloads designed to subvert the parsing logic—is introduced to the browser's processing engine. Because the Bisection component fails to properly sanitize or constrain the input, the injected code is interpreted as legitimate instructions by the component's internal logic.\nThe attack flow initiates when an attacker successfully delivers a crafted file to a target system. Once the Bisection process interacts with this malicious file, the injected code executes within the context of the component. By manipulating the environment in which Bisection operates, an attacker can bypass traditional sandbox boundaries or access memory segments that should remain isolated. This leads to the unauthorized extraction of sensitive information, such as cached credentials, session cookies, or local configuration data.\nThe exploitation process does not necessitate elevated privileges on the host operating system; however, it relies on the browser's ability to trigger the Bisection logic upon encountering the malicious artifact. The severity is magnified by the fact that Bisection processes often operate with broader access permissions than standard web-rendering processes to facilitate build diagnostics.\nThe vulnerable component, Bisection, is active in Chromium versions prior to 152.0.7977.65. The lack of stringent input verification allows the injected payload to hijack the execution flow during the file evaluation stage. Once the payload is executed, the attacker can leverage the resulting memory access to perform exfiltration of data, potentially leading to a broader compromise of the browser session. There are no authentication requirements for the delivery of the malicious file, as the vulnerability is triggered by the browser's automated processing mechanisms, confirming the remote nature of the exploit vector."
}