Chrome EUVD-2025-18072

This vulnerability presents a HIGH real-world risk despite being in the 'Use-After-Free' category, which is historically a class of bugs with strong exploitation potential. Risk factors: (1) CVSS 8.8 reflects network-accessible attack vector, low complexity, and no privilege requirement—only user interaction (UI:R) is needed, making it practical to exploit at scale via drive-by downloads or social engineering; (2) CWE-416 use-after-free vulnerabilities are consistently automatable and reliably exploitable for code execution, suggesting high EPSS probability if unknown or moderate-to-high if widely known; (3) The 'High' Chromium severity designation indicates this passed internal security review as a critical threat; (4) Media parsing is a high-risk code path frequently targeted by fuzzing and exploit development; (5) No mitigating factors like ASLR bypass requirements are noted. The primary constraint is user interaction—an attacker must convince the victim to visit a malicious page. However, given Chrome's widespread adoption and automatic update mechanisms, this is a priority patch for users. This is NOT a false-positive high-CVSS case; the technical impact (heap corruption leading to code execution) justifies the score.

An attacker creates a malicious website or embeds malicious HTML in a legitimate site (via stored XSS or advertising injection). The page contains a crafted media element (video, audio, or HTML5 media object) with malformed headers or payloads designed to trigger the use-after-free in Chrome's Media component. When a victim visits the page, Chrome's renderer process attempts to parse the media, triggering the memory corruption. The attacker's payload, residing adjacent to the freed memory, overwrites critical heap structures (e.g., function pointers or object metadata). Upon the next operation on the corrupted object, control flow is hijacked and arbitrary code executes with the privileges of the Chrome renderer process. This grants the attacker access to user data (cookies, passwords, local files) and can be chained with sandbox escape techniques to compromise the entire system. No special privileges or network access beyond HTTP/HTTPS are required; a single click from the user initiates the exploit chain.