Description

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:20.230Z",
  "pubdate": "2026-08-25T21:18:20.230Z",
  "executiveSummary": "A high-severity use-after-free (UAF) vulnerability exists within the Views component of Google Chrome prior to version 152.0.7977.65. This memory corruption flaw allows a remote attacker to achieve arbitrary code execution beyond the constraints of the browser sandbox.\nThe vulnerability occurs when the application incorrectly manages the lifecycle of memory objects, specifically within the UI framework. By tricking a user into navigating to a malicious HTML page, an attacker can trigger a dangling pointer dereference.\nThe impact is significant, as it grants the attacker the ability to execute unauthorized code on the victim's host system. This bypasses typical browser isolation mechanisms, effectively neutralizing sandbox protections. The vulnerability is exploitable via a remote network vector and does not require pre-existing authentication, making it a critical threat. Users and administrators are strongly advised to update to version 152.0.7977.65 or later to mitigate the risks of remote exploitation.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free condition residing in the Views UI toolkit component within the Chromium codebase. A use-after-free occurs when an application continues to utilize a pointer to a memory region after that memory has been freed or reallocated. In the context of Chrome's Views framework, certain UI components or objects fail to properly clear or nullify pointers after their destruction, leading to a state where a dangling pointer persists.\nExploitation is initiated when a remote attacker hosts a specially crafted HTML page. When a user visits this page, the browser's rendering engine processes elements that interact with the vulnerable Views component. The attacker leverages specific sequence operations—such as layout transitions, focus changes, or UI event firing—to force the application to free a specific memory object while simultaneously maintaining a reference to it.\nOnce the initial memory region is deallocated, the attacker performs heap grooming or heap spraying to populate the newly freed memory location with controlled data. When the browser subsequently dereferences the dangling pointer, it inadvertently executes or accesses the malicious data provided by the attacker, under the assumption that the memory object remains in a valid, initialized state.\nBecause the vulnerability exists in the underlying UI framework, successful exploitation allows the attacker to transition from the limited browser sandbox into the context of the host operating system. This is achieved by leveraging the corrupted memory state to hijack the control flow, eventually leading to arbitrary code execution (ACE). The exploit does not require authentication or elevated local privileges, as the trigger is fully handled by the browser's interpretation of the malicious HTML/JS payload. Post-exploitation, the attacker can execute arbitrary system commands, install persistent malware, or exfiltrate sensitive data, as the payload executes with the privileges of the logged-in user."
}