Description

Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-03T20:17:26.857Z",
  "pubdate": "2026-09-03T20:17:26.857Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) read flaw residing within the CrashReporting component of Google Chrome.\nThe issue permits a remote attacker who has already successfully compromised the renderer process to access and read memory regions located outside of the designated sandbox boundaries.\nGoogle Chrome versions prior to 152.0.7977.82 are affected by this high-severity security flaw.\nThe primary risk involves unauthorized information disclosure, as the ability to read arbitrary memory may allow an attacker to bypass security mechanisms or extract sensitive data stored in the process memory space.\nExploitation requires the attacker to achieve an initial compromise of the renderer process, typically achieved by convincing a user to navigate to a crafted HTML page containing malicious content.\nOnce the renderer process is compromised, the attacker can leverage this OOB read vulnerability to perform memory interrogation, potentially facilitating further exploitation chains or data exfiltration.",
  "technicalDetails": "The vulnerability is classified as an out-of-bounds read error occurring within the CrashReporting subsystem of the Chromium codebase. An OOB read occurs when software reads data past the intended buffer or memory allocation boundary. In this specific context, the flaw is triggered when the CrashReporting mechanism processes malformed or specifically crafted inputs during an error-handling or logging routine.\nThe attack flow begins when an attacker lures a user to a malicious webpage, resulting in the successful exploitation of a separate primary vulnerability (such as a Use-After-Free or Type Confusion) to gain arbitrary code execution within the isolated renderer process. Once the renderer process is compromised, the attacker operates within the restricted sandbox environment.\nBy invoking the CrashReporting API via the crafted HTML page, the attacker passes malicious arguments that cause the component to calculate an incorrect memory offset. This leads the reporting logic to read memory addresses outside of the permitted buffer. Because the renderer process is the entry point for web content, the CrashReporting subsystem performs operations that, if not properly bounds-checked, allow the reading of adjacent memory pages.\nSuccessful exploitation results in the disclosure of memory contents that would otherwise be protected by the sandbox. This memory may contain pointers, cryptographic keys, heap metadata, or other sensitive information residing within the address space of the renderer process. While this vulnerability does not inherently allow for remote code execution (RCE) outside the sandbox, it provides an essential primitive for defeating Address Space Layout Randomization (ASLR) or for leaking sensitive security tokens that could be utilized in subsequent attacks to escalate privileges.\nThe vulnerability is persistent in Google Chrome versions prior to 152.0.7977.82. No authentication is required by the attacker beyond the requirement to have established control over the renderer process through initial content-based exploitation. The flaw is fundamentally a failure in boundary verification within the component's internal logic, making it a critical concern for defense-in-depth and the integrity of the browser's security architecture."
}