Description

Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:22.307Z",
  "pubdate": "2026-08-25T21:18:22.307Z",
  "executiveSummary": "This vulnerability is a critical use-after-free (UAF) memory corruption flaw identified within the ANGLE (Almost Native Graphics Layer Engine) component of the Chromium project, specifically impacting Google Chrome on Android versions prior to 152.0.7977.65.\nThe vulnerability occurs when the application attempts to access memory that has been deallocated, leading to undefined behavior that can be weaponized by a remote attacker.\nThe primary risk associated with this flaw is the potential for arbitrary code execution (ACE). Because the vulnerability resides in a graphics-processing component, successful exploitation allows an attacker to bypass the browser's security sandbox, granting the malicious payload unauthorized access to the underlying Android operating system environment.\nThis issue is categorized as a high-severity threat due to its remote exploitability via crafted HTML content, requiring only that a user visits a malicious webpage. There are no specific authentication or local privileges required for an attacker to initiate the attack chain.\nGiven the nature of UAF vulnerabilities in browser engines, the exploitation process involves precise memory grooming to replace the freed object with attacker-controlled data, ultimately redirecting execution flow to malicious shellcode or a ROP (Return-Oriented Programming) chain.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free condition within the ANGLE graphics abstraction layer, which translates OpenGL ES API calls into platform-specific graphics APIs like Vulkan, Metal, or Direct3D. In this context, an object residing in heap memory is freed while a dangling pointer to that memory address remains active within the ANGLE rendering pipeline.\nExploitation is typically triggered via a crafted HTML page containing malicious JavaScript or WebGL/WebGPU calls designed to manipulate the browser's DOM or graphics memory management. By systematically spraying the heap and triggering garbage collection or specific memory-intensive rendering sequences, an attacker can influence the heap allocator to reclaim the previously freed memory block for an object under the attacker's control.\nThe attack flow follows a structured exploitation path: First, the attacker triggers the initial state that causes an object to be prematurely deallocated while maintaining a pointer to it. Second, the attacker performs 'heap grooming' to allocate controlled data into the memory segment vacated by the freed object. Third, the application accesses the dangling pointer, unknowingly referencing the attacker-injected data instead of the legitimate object. This leads to type confusion or a direct redirect of function pointers embedded within the object, enabling arbitrary code execution.\nBecause ANGLE operates as a crucial layer between the browser renderer process and the GPU drivers, this vulnerability provides a bridge to bypass standard browser-based sandboxing protections. By successfully corrupting the instruction pointer, an attacker can pivot from a restricted renderer process context into broader execution, potentially leading to persistent device compromise.\nThe vulnerability affects Chromium-based browsers on Android, specifically those integrating ANGLE versions susceptible to this memory management flaw. The lack of proper object lifecycle tracking or reference counting in the affected rendering module allows the state to persist into an invalid, exploitable condition. Post-exploitation, the attacker gains the ability to execute arbitrary native code, which may be leveraged for further system exploitation, data exfiltration, or the installation of malicious software within the Android ecosystem.\nThe attack does not require user interaction beyond navigating to the malicious URI, as the rendering process occurs automatically during the parsing of the web content."
}