Description

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-02T00:18:28.550Z",
  "pubdate": "2026-09-02T00:18:28.550Z",
  "executiveSummary": "A critical memory corruption vulnerability identified as a Use-After-Free (UAF) exists within the WebRTC implementation of Google Chrome. This flaw allows a remote attacker to achieve arbitrary code execution within the confines of the browser's security sandbox.\nThe vulnerability affects Chromium-based browsers prior to version 152.0.7977.75. By leveraging a specially crafted HTML page, an attacker can trigger the memory management error during WebRTC processing.\nThe impact is significant, as successful exploitation enables an attacker to execute malicious code on the victim's system, potentially leading to unauthorized data access, system instability, or further compromise of the host environment.\nAlthough the code execution occurs within the sandbox, which serves as a security layer, this vulnerability represents a severe risk to confidentiality, integrity, and availability. No user authentication is required, as the attack is facilitated through standard web interaction. Users are strongly advised to update to the patched version immediately.",
  "technicalDetails": "The vulnerability resides within the WebRTC component of the Chromium project, specifically concerning the lifecycle management of memory objects. A Use-After-Free (UAF) condition occurs when an application continues to use a pointer to a memory location after that memory has been deallocated or freed.\nIn the context of the WebRTC implementation, the vulnerability is triggered during specific operations where an object's reference count is improperly managed or where a callback mechanism accesses an object that has already been subject to a free operation. When the browser processes a crafted HTML page, the attacker can influence the heap layout or manipulate the timing of asynchronous events to ensure that a dangling pointer is dereferenced.\nThe attack flow begins when a user navigates to a malicious webpage containing JavaScript or HTML elements designed to interact with the WebRTC API. The attacker leverages these primitives to trigger the underlying memory corruption. Upon the reallocation of the freed memory block with attacker-controlled data, the dangling pointer is used to read or write, or potentially to redirect the execution flow by overwriting virtual function tables (vtable) or other critical control structures.\nBecause this vulnerability occurs within the WebRTC component, which handles real-time media streaming, the exploitation vector is highly accessible via standard browser rendering processes. While the execution is constrained by the browser's sandbox environment, the ability to achieve arbitrary code execution at this level is a precursor to potential sandbox escape vulnerabilities, thereby increasing the overall severity of the threat.\nAffected versions include all Chromium-based browser distributions prior to 152.0.7977.75. The exploitation does not require the user to provide credentials or bypass authentication; the act of rendering the malicious document within the browser's media processing engine is sufficient to initiate the exploit sequence.\nPost-exploitation impact within the sandbox includes the ability to execute unauthorized logic, scrape local browser data, or probe for additional vulnerabilities within the browser process that could lead to a full system compromise. The technical failure is rooted in the C++ memory management logic within the WebRTC stack, specifically lacking robust synchronization or reference counting safeguards during high-concurrency object lifecycle transitions."
}