Description

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:23.197Z",
  "pubdate": "2026-08-25T21:18:23.197Z",
  "executiveSummary": "This vulnerability is a critical Use-After-Free (UAF) memory corruption flaw identified within the Aura windowing system component of Google Chrome.\nThe vulnerability allows a remote, unauthenticated attacker to achieve arbitrary code execution beyond the confines of the browser sandbox by enticing a user to navigate to a specifically crafted HTML page.\nAs a Use-After-Free exploit, the flaw stems from improper memory management, where a program continues to use a pointer after the memory it references has been deallocated.\nThis behavior facilitates memory manipulation, enabling attackers to corrupt data structures or hijack control flow to execute malicious payloads.\nGiven the 'Critical' severity classification, successful exploitation results in complete compromise of the target machine within the context of the user, potentially bypassing critical OS-level security boundaries.\nAffected systems include all versions of Google Chrome prior to 152.0.7977.65.\nThe primary risk implication is the potential for silent drive-by compromise, requiring no user interaction beyond visiting a malicious web resource.",
  "technicalDetails": "The vulnerability resides in the Aura component of Chromium, which serves as the cross-platform UI framework and window manager.\nThe root cause is a Use-After-Free (UAF) condition during the object lifecycle management of UI elements or window management structures within the Aura environment.\nA UAF occurs when an application fails to clear a pointer after freeing the memory it points to, leaving a 'dangling pointer'. If the application subsequently accesses this dangling pointer, it interacts with memory that may have been repurposed for other objects, leading to undefined behavior, data corruption, or code execution.\nIn the context of this vulnerability, a remote attacker leverages a crafted HTML document to induce a sequence of events that triggers the premature deallocation of an Aura-related object while maintaining a reference to it.\nBy controlling the heap state—often through techniques like Heap Spraying or grooming—the attacker can replace the freed memory block with a malicious object containing controlled data, such as a forged vtable or function pointers.\nWhen the browser attempts to interact with the dangling pointer, it inadvertently invokes the attacker-controlled code, leading to arbitrary code execution.\nThe exploitation flow typically involves: 1) The browser rendering a malicious webpage that contains scripts designed to manipulate DOM elements or internal Aura state, triggering the lifecycle mismanagement. 2) The browser frees an internal object but retains a pointer. 3) The attacker utilizes heap grooming to overwrite the memory address of the freed object with arbitrary data. 4) The browser performs a subsequent operation involving the dangling pointer, causing it to jump to the attacker's shellcode or return-oriented programming (ROP) chain.\nThe attack is performed remotely over the network, requiring no prior authentication or local privileges. Because the vulnerability allows for a sandbox escape, the impact transcends simple browser compromise, granting the attacker the ability to execute instructions with the privileges of the logged-in user, which may further lead to system-wide persistence or lateral movement depending on the user's privilege level and system configuration.\nThis vulnerability is specifically constrained to Chrome versions prior to 152.0.7977.65, where the memory management logic for Aura windows was updated to ensure safer object deletion and pointer nullification protocols."
}