Description

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:21.213Z",
  "pubdate": "2026-08-25T21:18:21.213Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) flaw residing within the Google Chrome DevTools component. The issue allows a remote attacker to achieve arbitrary code execution within the browser's sandbox environment.\nThe vulnerability is triggered by leveraging social engineering to convince a user to install or interact with a maliciously crafted Chrome extension. Successful exploitation bypasses standard browser security boundaries to execute attacker-controlled code.\nAffected systems include Google Chrome versions prior to 152.0.7977.65. While the Chromium project classifies this as a Medium severity issue, the potential for arbitrary code execution poses a significant threat to local data integrity and user privacy.\nExploitation requires the attacker to successfully deploy a crafted extension, necessitating user interaction. Once the extension is active, the UAF condition can be triggered, leading to memory corruption and potential control over the renderer process.",
  "technicalDetails": "The vulnerability originates from a Use-After-Free (UAF) condition within the DevTools component of the Chromium browser engine. A UAF vulnerability occurs when an application continues to use a pointer to a memory location after that memory has been freed. In this instance, the flaw manifests when the DevTools infrastructure mishandles the object lifecycle, resulting in a dangling pointer.\nThe attack flow begins with the delivery of a crafted Chrome extension designed to interact with specific DevTools APIs or internal state triggers. Through social engineering, the attacker induces the user to install this malicious extension. Once installed, the extension executes code that interacts with the vulnerable DevTools component, forcing the engine to deallocate an object while maintaining a reference to it.\nThe attacker then performs heap grooming or spraying to populate the previously freed memory space with controlled data. When the DevTools component subsequently attempts to access the stale pointer, it operates on the attacker-supplied payload. This provides the attacker with a primitive to manipulate control flow or state within the context of the renderer process.\nBecause this execution occurs inside the Chrome sandbox, the initial impact is limited to the renderer process. However, by leveraging this UAF to achieve arbitrary code execution, an attacker can further attempt to exploit auxiliary vulnerabilities—such as sandbox escapes or logic flaws—to escalate privileges or gain persistent access to the host system.\nThe vulnerability specifically impacts Google Chrome versions prior to 152.0.7977.65. The exploitation is remote in nature, dependent on the successful delivery and installation of the malicious extension via social engineering tactics. No specific authentication is required beyond the user's consent to install the extension, and the exploit operates within the privilege boundaries of the affected sandbox process."
}