Description

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-02T00:18:29.203Z",
  "pubdate": "2026-09-02T00:18:29.203Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Shared Tab Groups feature of Google Chrome on Android. This vulnerability, classified with a Critical severity, allows a remote attacker to achieve arbitrary code execution outside the browser sandbox.\nThe flaw originates from improper memory management within the browser's tab grouping implementation. By employing social engineering tactics to induce a user to interact with a maliciously crafted HTML page, an attacker can trigger the UAF condition.\nSuccessful exploitation grants the attacker the ability to execute arbitrary code with privileges exceeding those of the browser's internal sandbox, potentially leading to full device compromise. This represents a significant security risk, as it bypasses standard browser isolation protections, enabling persistent access or sensitive data exfiltration.\nAffected systems include Google Chrome on Android versions prior to 152.0.7977.75. There are no authentication requirements for exploitation, as the vector relies on client-side navigation to a malicious resource. Users are urged to apply updates immediately to mitigate the risk of remote exploitation.",
  "technicalDetails": "The vulnerability is identified as a Use-After-Free (UAF) memory corruption flaw occurring within the browser's handling of Shared Tab Groups. A UAF vulnerability manifests when an application continues to use a pointer to a memory location after that memory has been freed or deallocated. In this specific context, the Chromium engine fails to properly manage the lifecycle of objects associated with Shared Tab Groups during complex asynchronous operations.\nThe attack flow begins when a remote attacker distributes a link to a specially crafted HTML page. When rendered by a vulnerable version of Google Chrome on Android, this page triggers a sequence of operations that force the browser to free an object related to the Shared Tab Groups functionality while maintaining a dangling pointer to that memory address. Due to inadequate synchronization or reference counting mechanisms, the browser attempts to access this stale memory address.\nUpon accessing the deallocated memory, the attacker can influence the state of the heap by performing heap spraying or other memory grooming techniques to place controlled data at the reclaimed memory location. By crafting this data, the attacker can manipulate internal browser state, control instruction pointers, or redirect execution flow to attacker-supplied shellcode or Return-Oriented Programming (ROP) gadgets.\nThe impact is elevated by the ability to execute arbitrary code outside the browser's sandbox. In Chromium, the sandbox provides a critical layer of defense-in-depth, restricting the browser's ability to interact with the underlying Android operating system, filesystem, and user data. By escaping the sandbox, the attacker bypasses these security boundaries, gaining the ability to execute code with the permissions of the application process or, depending on the nature of the exploit and subsequent privilege escalation, deeper access to the Android environment.\nThe technical root cause involves a race condition or logic error in the component responsible for synchronizing tab group state across the browser's internal threading model. Because the browser fails to nullify pointers or invalidate references before the memory is returned to the allocator, a malicious payload can replace the contents of the memory chunk with attacker-controlled objects. This results in the invocation of arbitrary functions or corrupted methods, providing the attacker with execution primitives necessary to hijack control flow."
}