Description

Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:18:20.887Z",
  "pubdate": "2026-08-25T21:18:20.887Z",
  "executiveSummary": "A race condition vulnerability has been identified within the Extensions subsystem of Google Chrome, affecting versions prior to 152.0.7977.65. This security flaw allows a remote, unauthenticated attacker to execute arbitrary code within the context of the browser's sandbox. The vulnerability stems from improper synchronization or handling of resources during the processing of network traffic.\nThe risk implication is significant due to the potential for remote code execution, which could be leveraged to bypass browser security boundaries. Successful exploitation requires the victim to process specifically crafted network traffic while the vulnerable extension functionality is active. While the Chromium security severity is rated as 'Low,' the capability for arbitrary code execution within the sandbox represents a breakdown in the expected security isolation mechanisms, potentially facilitating further attacks or data exfiltration if chained with other vulnerabilities.\nUsers and administrators are advised to prioritize updating to version 152.0.7977.65 or later to mitigate this risk, as no known workarounds offer equivalent protection against the exploitation of this race condition.",
  "technicalDetails": "The vulnerability is characterized as a race condition residing within the Extensions component of the Chromium codebase. A race condition occurs when the system's security posture is dependent on the sequence or timing of uncontrollable events, such as thread scheduling or network packet arrival. In this instance, the flaw manifests during the processing of crafted network traffic handled by the Extensions framework.\nThe root cause involves an asynchronous operation where the state of a resource or internal memory buffer is not properly protected by locking mechanisms or atomic operations during concurrent access. When an attacker sends a series of crafted network requests, they may induce a scenario where the browser attempts to access or modify a resource that is currently in an inconsistent or transitioning state. This lack of thread-safe handling allows the attacker to manipulate the execution flow, leading to memory corruption or unsafe object dereferencing within the sandboxed environment.\nThe attack flow begins with the delivery of malicious network traffic, likely facilitated by a compromised or malicious web resource that interacts with a vulnerable extension installed in the victim's browser. Upon receiving the traffic, the Extensions component triggers the flawed asynchronous process. By precisely timing the arrival of specific packets, the attacker forces a race between the browser's internal threads. If the attacker wins the race, they can potentially trigger a 'use-after-free' or similar memory access error, allowing for the redirection of the instruction pointer.\nExploitation occurs within the browser sandbox. While the sandbox provides a layer of defense by restricting the process from interacting with the underlying operating system kernel or filesystem, successful exploitation results in arbitrary code execution within the browser's process space. This allows the attacker to execute code as the browser process, which could include reading browser-stored credentials, manipulating web content, or further probing the sandbox for additional vulnerabilities to facilitate a sandbox escape. The exploit does not require prior authentication from the user, as it relies on the automated processing of network-delivered content. The complexity of achieving a reliable exploit for a race condition of this nature is high, but the impact remains critical for users who have extensions installed that handle external network traffic."
}