Executive brief
Google Chrome's developer tools contain a use-after-free vulnerability that allows attackers to execute arbitrary code outside Chrome's security sandbox via a malicious HTML page. This bypass of Chrome's sandbox protection could enable attackers to compromise the underlying system, steal sensitive data, or install malware with full system privileges rather than being confined to the browser process.
Technical details
A use-after-free memory safety bug exists in Chrome's DevTools component, where memory is accessed after it has been freed. An attacker can trigger this vulnerability by crafting a malicious HTML page that, when opened in Chrome, causes the vulnerability to be exploited. The flaw allows remote code execution outside the Chrome sandbox—a critical escape mechanism that bypasses Chrome's primary security boundary. The vulnerability affects Chrome versions prior to 152.0.7977.82 and was patched in the stable channel release on September 3, 2026. The attack requires only that a user visit or be directed to a malicious webpage; no user interaction beyond normal browsing is necessary.
Affected products
- Google Chrome prior to 152.0.7977.82
Timeline
- 2026-09-03: disclosed: Reported by Google on 2026-08-26; patched in Chrome 152.0.7977.82
- 2026-09-03: patched: Fixed in stable channel update 152.0.7977.82/.83 for Windows/Mac and 152.0.7977.82 for Linux