Google Chrome 152 Memory Safety and Authorization Flaws

Access-restriction bypass in Google Chrome desktop prior to 152.0.7977.75 lets a remote attacker who first tricks a user via social engineering leverage a co-installed application to escape Chrome's system access boundaries. The flaw is an improper input validation (CWE-20) issue in the browser's DataTransfer component, rated High by Chromium and fixed in the September 2026 Stable channel. EPSS is low (0.16%, 5th percentile), no public exploit or CISA KEV listing exists, so realistic risk is bounded by the required user interaction and the presence of a malicious co-installed app.

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.

Sandbox escape and out-of-sandbox arbitrary code execution in Google Chrome (desktop) before 152.0.7977.75, rooted in an incorrect authorization flaw in the FileSystem component. A remote attacker who lures a victim into opening a crafted HTML page can break out of the renderer sandbox and run code with the privileges of the browser process. Rated High by Chromium and CVSS 9.6; the vendor has shipped a stable-channel patch, though no public exploit code or active exploitation has been identified at time of analysis.

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the Shared Tab Groups feature (CWE-416). A remote attacker who lures a victim into visiting a crafted HTML page can corrupt freed memory to execute arbitrary code outside the renderer sandbox. Chromium rates the severity Critical (CVSS 9.6); the vendor has shipped a fix, but no public exploit has been identified at time of analysis.

Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.

Remote code execution in Google Chrome desktop before 152.0.7977.75 stems from a use-after-free in the Proxy component that a remote attacker can trigger with crafted network traffic to run arbitrary code OUTSIDE the browser sandbox. Google rates the Chromium severity High and a patched Stable channel build is available; no public exploit code has been identified at time of analysis. Because the flaw yields a sandbox escape rather than a contained renderer bug, successful exploitation gives attacker-controlled code on the host at browser-process privilege.

Use-after-free in Chrome's TabStrip component enables remote code execution outside the renderer sandbox in Google Chrome versions prior to 152.0.7977.75. An attacker must social-engineer a user into a specific UI interaction to trigger the memory-corruption primitive, after which arbitrary code executes at browser-process privilege - a full sandbox escape. Google has issued a stable channel patch; no public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution inside Chrome's sandbox is achievable via a use-after-free in WebRTC, triggered when a victim visits a specially crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75 across desktop platforms. No public exploit code or CISA KEV listing has been identified at time of analysis, though the sandboxed execution boundary limits the practical impact compared to the raw CVSS 8.8 score - Google's own Chromium severity rating of 'Medium' reflects this containment.

Remote code execution within the browser sandbox is possible in Google Chrome versions prior to 152.0.7977.75 due to a use-of-uninitialized-resource flaw (CWE-908) in the V8 JavaScript engine. An attacker can trigger the vulnerability by luring a user to a crafted HTML page, with no authentication or special privileges required beyond normal web browsing. Google has released the patched build 152.0.7977.75; SSVC rates exploitation status as none and no CISA KEV listing has been identified at time of analysis.

Sandbox escape in Google Chrome's TabStrip component (versions prior to 152.0.7977.75) allows a remote attacker who has already achieved renderer process compromise to execute arbitrary code outside the Chrome sandbox via incorrect authorization in tab management IPC. The attack chain requires two conditions to be met simultaneously: a prior renderer exploit and social engineering to deliver a crafted HTML page - placing this firmly in the chained-exploit category despite the high CVSS base score. A vendor-released patch is available in Chrome 152.0.7977.75; no public exploit code or active exploitation has been identified at time of analysis.

Stack-based buffer overflow in the GPU component of Google Chrome on Windows (prior to 152.0.7977.75) enables full sandbox escape and arbitrary code execution on the host operating system. Exploitation is a two-stage chained attack: an attacker must first compromise the renderer process (via a separate vulnerability or exploit), then leverage this GPU flaw to break out of Chrome's sandbox and execute code with elevated host privileges. Google has released a patch in the stable channel update for desktop; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Google Chrome's Browser process prior to version 152.0.7977.75 enables sandbox escape, allowing an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The CVSS vector (AV:N/AC:H/S:C/C:H/I:H/A:H) reflects both the network-reachable delivery and the scope change from renderer to host-level execution. No public exploit or CISA KEV listing has been identified at time of analysis, but sandbox-escape primitives of this class are highly valued in exploit chains.

Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox via a crafted local program, affecting all Chrome for Windows versions prior to 152.0.7977.75. The root cause is incorrect authorization (CWE-863) within the Chromoting subsystem, where flawed authorization logic fails to restrict a local program from interacting with Chromoting in a way that crosses the sandbox boundary. Google has released a patched version (152.0.7977.75), and no public exploit has been identified at time of analysis, though the full post-sandbox C:H/I:H/A:H impact warrants prompt remediation.

Origin policy bypass in Google Chrome's Omnibox (address bar) prior to version 152.0.7977.75 allows remote attackers using social engineering and crafted network traffic to circumvent the web same-origin policy, enabling high-integrity cross-origin manipulation. The CVSS vector confirms user interaction is required, meaning the attack cannot be fully automated and depends on deceiving the victim. No public exploit code or active exploitation has been identified; EPSS of 0.16% (5th percentile) reflects low near-term exploitation probability.

Incorrect authorization in Chrome's SiteSettings component (versions prior to 152.0.7977.75) allows an unauthenticated remote attacker to bypass system-level site access restrictions via a crafted HTML page. The attack requires user interaction - the victim must visit the attacker-controlled page - and the primary impact is a high-integrity authorization bypass, potentially allowing a malicious page to access system resources (e.g., geolocation, camera) that should be gated behind permission prompts. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.17% reflects low near-term exploitation probability despite Chrome's massive global deployment footprint.

Incorrect authorization in Chrome's Autofill component on Android (prior to 152.0.7977.75) exposes sensitive Autofill-stored data - potentially including saved credentials, addresses, or payment details - to a remote attacker who can socially engineer a victim into visiting a crafted HTML page. The flaw is platform-specific to Chrome on Android and requires active user interaction via social engineering, which limits real-world exploitation friction somewhat. Google has released a patch and no public exploit code has been identified at time of analysis.

Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.

Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.

Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 enables sensitive information disclosure through a two-stage attack chain requiring a pre-compromised renderer process and social engineering. The CVSS vector (AC:H/UI:R) accurately reflects the chained nature of exploitation: an attacker must first compromise the renderer, then induce user interaction with a crafted HTML page to bypass FileSystem access controls. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patch was released in the September 2026 stable channel update.

Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.

Address bar spoofing in Google Chrome prior to version 152.0.7977.75 allows remote attackers to visually deceive users by manipulating the browser's fullscreen UI state through a crafted HTML page, causing the displayed origin to misrepresent the actual site being visited. The vulnerability (CWE-451) carries no confidentiality or availability impact - the risk is exclusively to integrity through phishing enablement, consistent with Google's own 'Low' severity designation. No public exploit code has been identified, and exploitation probability is negligible at EPSS 0.16% (6th percentile).

Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.

Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 allows an attacker who has already achieved renderer process compromise to bypass the web origin policy via a crafted HTML page. The flaw (CWE-862) grants cross-origin file access that the browser's same-origin policy should prohibit, extending the impact of any renderer exploitation chain. Chromium's own severity rating of Medium aligns with the strict prerequisite of prior renderer compromise; SSVC rates exploitation as none and technical impact as only partial.

Incorrect authorization in Chrome's Actor component allows a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75, which carries the fix. Chromium's own severity rating is Low, consistent with the CVSS 3.1 base score of 3.1 and the requirement for a pre-compromised renderer as a prerequisite; no public exploit or active exploitation is identified at time of analysis.

Incorrect authorization in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to bypass the web same-origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75. This is a chained, second-stage exploitation primitive - it does not grant initial access but extends the reach of an already-compromised renderer, enabling limited cross-origin data reads. SSVC and CVSS both assess technical impact as partial with no active exploitation identified.

Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.