Executive brief
A use-after-free vulnerability in Google Chrome's extension system allows attackers to execute arbitrary code outside the browser sandbox by installing a malicious extension. This enables complete compromise of the affected system, including access to sensitive user data, credential theft, and malware installation.
Technical details
A use-after-free vulnerability exists in the Chrome Extensions component, allowing an attacker to reference memory after it has been freed. The vulnerability can be triggered via a crafted Chrome extension and permits code execution outside the sandbox boundary. The attack vector requires the victim to install or accept a malicious extension, but once triggered, results in arbitrary code execution with full system privileges. This issue was patched in Chrome version 153.0.8010.52 and later. The vulnerability was reported to Google on 2026-08-26.
Affected products
- Google Chrome prior to 153.0.8010.52
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in Chrome 153.0.8010.52 and later