Description

Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T20:17:26.420Z",
  "pubdate": "2026-09-03T20:17:26.420Z",
  "executiveSummary": "A critical type confusion vulnerability exists within the Compositing component of Google Chrome. This flaw allows a remote, unauthenticated attacker to execute arbitrary code within the renderer sandbox environment. The vulnerability arises from improper handling of object types during the rendering process, which can be triggered by a specially crafted HTML page. Successful exploitation requires the user to interact with malicious content, leading to memory corruption. Given the nature of the vulnerability, the potential impact includes bypassing security restrictions and achieving remote code execution (RCE) within the restricted sandbox process. This vulnerability is rated as High severity, necessitating prompt updates to address the underlying logic error in the browser engine.\nAffected software includes versions of Google Chrome prior to 152.0.7977.82. The risk implications are significant, as attackers can leverage this flaw to compromise browser integrity, leading to data exfiltration or potential escalation if chained with secondary exploits. Exploitation relies on the browser's interaction with malformed web content, making it a viable target for drive-by download attacks or malicious advertisements.",
  "technicalDetails": "The vulnerability is a type confusion flaw located in the Chromium Compositing subsystem. Type confusion occurs when the browser's engine incorrectly interprets a memory buffer or an object as a different type than it actually is. In the context of Compositing, this typically happens when the browser performs operations on compositor-related data structures without adequate verification of the underlying class or data type.\nIn this specific instance, the flaw manifests when the compositor processes malicious layout or rendering properties provided via a crafted HTML page. If the attacker can induce the engine to treat a legitimate object of one class as a different class that shares a similar memory structure but carries different pointer offsets or vtable entries, they can gain unauthorized control over the execution flow.\nThe exploitation flow follows these steps: First, an attacker hosts a malicious HTML page containing complex CSS or DOM manipulations designed to trigger an edge case in the Compositor’s resource management. As the browser parses this content, it attempts to map internal properties for visual rendering. If the specific type confusion state is reached, the browser might attempt to execute a method or access a memory address using an invalid or corrupted pointer provided by the attacker.\nBy carefully controlling the heap layout—often through techniques such as heap spraying or precise allocation of large objects—the attacker can influence the state of the corrupted memory. When the renderer engine attempts to access a virtual function or a data member on the misidentified object, it follows a hijacked pointer. This allows for arbitrary memory read/write operations or the hijacking of the instruction pointer, ultimately facilitating arbitrary code execution within the confines of the renderer process sandbox.\nBecause this code execution occurs within the sandbox, the immediate impact is restricted to the renderer process. However, the compromise of this process is a critical prerequisite for further attacks, such as sandbox escapes, which could lead to persistent compromise of the host system. The vulnerability is triggered remotely without requiring user authentication, relying entirely on the rendering of the malicious page content by the targeted Chromium-based application. Affected versions include all instances of Google Chrome prior to the patched version 152.0.7977.82."
}