Executive brief
Google Chrome's Network component contains a use-after-free vulnerability that allows a remote attacker with an already-compromised renderer process to bypass same-origin policy restrictions via a malicious HTML page. This could enable attackers to access sensitive data from other websites or perform actions on behalf of users across different web origins.
Technical details
The vulnerability is a use-after-free (CWE-416) in Chrome's Network component that occurs when a resource is accessed after being freed from memory. The attack requires the renderer process to be previously compromised, making this a post-exploitation vector rather than an initial entry point. An attacker can craft a malicious HTML page that exploits this condition to bypass the web origin policy (same-origin policy). The vulnerability affects Chrome versions prior to 152.0.7977.65 and was fixed in the Chrome 152 stable release on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Chrome 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux)