Executive brief
Google Chrome's Navigation system failed to properly enforce privilege boundaries, allowing attackers who had compromised the rendering engine to escape the browser's sandbox and execute arbitrary code on the user's system. An attacker would need to first compromise the renderer process and use social engineering to trick the user into visiting a malicious webpage. Successfully exploiting this vulnerability could give an attacker full control over the victim's computer.
Technical details
The vulnerability is an improper privilege management flaw in Chrome's Navigation component prior to version 152.0.7977.65. The root cause involves inadequate privilege boundary enforcement between the sandboxed renderer process and the browser process. An attacker who has already compromised the renderer process can craft a malicious HTML page that, combined with social engineering, leverages the Navigation privilege escalation to execute arbitrary code outside the sandbox. The attack requires prior renderer compromise and user interaction. The vulnerability was patched in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed: Published in Chrome 152 stable release notes
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65