CVE-2026-84324 in Chrome
Summary
by MITRE • 09/02/2026
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a use-after-free condition within the proxy handling subsystem of Google Chrome prior to version 152.0.7977.75 represents a critical memory corruption flaw that undermines the browser's core security architecture. This specific defect arises when the application fails to properly manage the lifecycle of memory objects associated with network proxy configurations or connections. In typical operation, these objects are allocated dynamically during the establishment of network requests and deallocated once their utility expires or upon connection closure. However, due to a logic error in the reference counting or pointer invalidation mechanisms, certain pointers to these freed memory regions remain accessible within active data structures. This creates a window where an attacker can manipulate the state of the application by interacting with memory that has already been returned to the system allocator for reuse.
From a technical perspective, this flaw aligns closely with CWE-416, which classifies use-after-free errors as situations where software continues to use pointers after they have been freed. In the context of Chrome's sandboxed environment, such vulnerabilities are particularly dangerous because they can lead to arbitrary code execution outside the restricted security boundaries designed to isolate web content from the host operating system. When a remote attacker crafts specific network traffic that triggers this race condition or state inconsistency, they can overwrite adjacent memory structures with controlled data. This manipulation allows for precise control over program flow, potentially enabling the exploitation of other mitigations such as heap spraying techniques to achieve code execution in an unrestricted context.
The operational impact of this vulnerability is severe, classified by Chromium security teams as High severity due to its potential for remote code execution without user interaction beyond visiting a maliciously crafted site or receiving specially designed network packets. An attacker leveraging this flaw could bypass the sandbox isolation that protects users from malicious web content. This means that successful exploitation would grant the adversary full control over the underlying operating system, allowing them to install programs, view, change, or delete data, and create new accounts with full user rights. The ability to execute code outside the sandbox effectively neutralizes one of the most important defense-in-depth layers employed by modern web browsers, exposing end-users to significant risk of compromise through standard internet browsing activities.
This incident is also relevant to the MITRE ATT&CK framework, specifically mapping to techniques involving memory corruption and privilege escalation within browser-based attacks. The exploitation vector relies on crafted network traffic, which corresponds to initial access or execution phases where malicious payloads are delivered via web content or direct network interactions. To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 152.0.7977.75 or later immediately upon availability. Additionally, implementing strict browser policies and monitoring for unusual outbound connections can provide an additional layer of defense against potential exploitation attempts while patching is being deployed across the enterprise environment.