Description

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T20:17:23.570Z",
  "pubdate": "2026-09-03T20:17:23.570Z",
  "executiveSummary": "A use-after-free vulnerability exists in Google Chrome for Android, specifically involving the improper management of released resources. The vulnerability facilitates a bypass of the web origin policy, a fundamental security boundary in browser architecture.\nThe flaw affects Google Chrome on Android versions prior to 152.0.7977.82. Successful exploitation allows a remote attacker to circumvent same-origin policy (SOP) restrictions, potentially leading to unauthorized cross-origin data access.\nExploitation requires the attacker to successfully employ social engineering techniques to entice a user into navigating to a specifically crafted HTML page. Given the nature of this flaw, the risk is classified as Medium, as the requirement for user interaction limits the immediate scope of attack, but the bypass of core security controls poses significant data confidentiality risks.\nThis vulnerability is rooted in how the browser handles memory references after objects have been deallocated, which can be leveraged to manipulate the internal state of the rendering engine.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free (UAF) condition within the Chromium rendering engine. In C++ based browser architectures, a use-after-free occurs when an application continues to use a pointer after the memory address it references has been deallocated or freed. If the memory is subsequently reallocated for a different purpose, the stale pointer may allow an attacker to read or overwrite the contents of the new object, leading to controlled data corruption or arbitrary code execution.\nIn this specific instance, the vulnerable component resides within the resource management subsystem of Google Chrome for Android. When a specific resource—likely an internal object involved in origin tracking or document lifecycle management—is improperly released while still being referenced by another part of the browser's rendering process, a dangling pointer is created.\nThe attack flow begins when a remote attacker hosts a malicious HTML page containing specifically crafted script and DOM elements designed to trigger the lifecycle management error. Through social engineering, the attacker directs the user to this page within the Chrome for Android environment.\nAs the browser processes the crafted HTML, it triggers the premature release of the target resource. Because the browser continues to maintain a reference to this freed memory, the attacker can influence the heap layout. By populating the heap with controlled data, the attacker can ensure the memory previously occupied by the freed object is reallocated to a structure that the attacker can manipulate.\nOnce the reallocated memory is accessed via the dangling pointer, the browser incorrectly processes the attacker-supplied data as if it belonged to the original object. In the context of this CVE, this state confusion is used to bypass the web origin policy. By corrupting the internal origin-checking logic, the attacker can force the browser to treat a malicious, cross-origin request as originating from a trusted, different origin.\nThis violation of the same-origin policy allows for the unauthorized reading of sensitive data from different origins, such as cookies, local storage, or session-specific tokens, thereby compromising the security isolation model between websites. The vulnerability does not require prior authentication or elevated privileges, relying instead on the victim's interaction with the malicious page to initiate the UAF sequence."
}