Description

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-03T20:17:25.160Z",
  "pubdate": "2026-09-03T20:17:25.160Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified within the Compositing component of Google Chrome prior to version 152.0.7977.82. The flaw exists due to improper memory management during rendering operations, allowing a remote attacker who has already achieved initial execution within the renderer process to escape the sandbox.\nThe vulnerability carries a high security severity rating, reflecting the potential for arbitrary code execution on the host operating system. Successful exploitation necessitates that an attacker first compromises the renderer process, typically through a secondary entry point such as a malicious HTML page. Once triggered, the UAF condition allows the attacker to manipulate memory pointers, leading to unauthorized code execution outside the restricted sandboxed environment. This poses a significant risk to user data confidentiality, integrity, and system availability. Organizations should prioritize updating to the patched version to neutralize this escalation vector.",
  "technicalDetails": "The vulnerability is a classic Use-After-Free (UAF) flaw residing within the Chromium Compositing engine. Compositing is a complex subsystem responsible for orchestrating layers, textures, and geometry to render web pages efficiently. The root cause involves a logic error where memory allocated for a compositing object is prematurely freed while a dangling pointer remains active in the renderer's memory space.\nAttack flow typically begins with the delivery of a crafted HTML page designed to trigger an edge case in the compositing pipeline. An attacker must first establish control over the renderer process, likely by leveraging a prior browser-side or script-engine vulnerability to bypass basic protections. Once the attacker has a foothold in the renderer, they can manipulate the Document Object Model (DOM) or style attributes to force the Compositing component to perform specific operations on the dangling object. By spraying the heap or carefully timing the triggering of the UAF, the attacker can replace the freed memory block with a controlled object.\nWhen the compositor subsequently attempts to access the invalid pointer, it interacts with the attacker-controlled memory instead of the intended object. This facilitates a primitive for type confusion or control flow hijacking. By overwriting function pointers or object vtables within the reallocated memory, the attacker can redirect the execution flow to a payload embedded within the compromised renderer process. Because the compositor runs with higher privileges or interacts with IPC (Inter-Process Communication) mechanisms, the exploit can be leveraged to escape the renderer sandbox.\nThis sandbox escape is critical because it allows the attacker to bypass the security boundaries enforced by the Chromium architecture, effectively transitioning from restricted renderer-level access to arbitrary code execution at the privilege level of the browser process or the underlying user account. The vulnerability does not require authentication to the browser itself, as the exploit is triggered solely through the rendering of a malicious webpage. Given the architectural complexity of the Compositing subsystem, these flaws are particularly dangerous as they often reside in paths where memory ownership semantics are highly dynamic and difficult to track via static analysis."
}