CVE-2026-84353 in Chrome
Summary
by MITRE • 09/02/2026
Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a use-after-free error within the Shared Tab Groups feature of Google Chrome on Android represents a critical memory corruption flaw that undermines the browser's core isolation mechanisms. This specific defect resides in how the application manages memory allocation and deallocation for tab group objects when they are synchronized or shared across devices via user accounts. When an object is freed from memory but references to it remain active within the runtime environment, any subsequent access to those dangling pointers results in undefined behavior. In this context, a remote attacker can exploit this race condition by crafting a malicious HTML page that triggers the premature deallocation of tab group data structures while they are still being referenced by other parts of the browser process. This scenario allows for arbitrary read and write operations within the memory space of the Chrome renderer or utility processes, effectively bypassing standard sandbox protections designed to contain web content execution.
From a technical perspective, this vulnerability falls under CWE-416, which classifies use-after-free errors as a significant category of software weaknesses leading to security vulnerabilities. The exploitation vector relies heavily on social engineering tactics, requiring the victim to visit a specially crafted webpage that initiates the sequence of events leading to memory corruption. Once the attacker gains control over the program flow through this memory manipulation, they can inject and execute arbitrary code within the context of the affected process. Because Chrome employs a multi-process architecture with strict sandboxing, achieving code execution outside these sandboxes is particularly dangerous as it grants the attacker elevated privileges relative to the restricted environment where web content typically runs. This capability enables the potential for full device compromise if subsequent privilege escalation techniques are employed or if sensitive data stored in less protected processes is accessed.
The operational impact of this vulnerability extends beyond simple code execution, posing a severe risk to user privacy and system integrity. An attacker leveraging this flaw could potentially exfiltrate browsing history, saved passwords, cookies containing session tokens, and other personally identifiable information stored within the browser profile. Furthermore, by executing arbitrary code outside the sandbox, the malware can interact with native APIs on the Android operating system, allowing for actions such as installing additional malicious applications, monitoring user input, or accessing camera and microphone permissions without explicit consent. The critical severity assigned by Chromium security reflects the high likelihood of successful exploitation given the widespread use of shared tab features and the complexity involved in reliably triggering memory corruption bugs in modern browsers.
Mitigation strategies primarily involve immediate software updates to ensure that all Android devices are running Google Chrome version 152.0.7977.75 or later, where these memory management issues have been addressed through rigorous code review and fuzzing efforts. Users should enable automatic update notifications to receive patches promptly as they become available. From a defensive posture perspective, organizations can enforce policies that restrict the installation of unverified applications on managed devices, reducing the impact if an attacker successfully escalates privileges post-exploitation. Additionally, deploying mobile device management solutions with application whitelisting capabilities can prevent the execution of known malicious payloads even if initial browser sandboxing is bypassed. Security awareness training remains crucial to mitigate the social engineering aspect, as users must be educated to recognize and avoid visiting suspicious or untrusted websites that may attempt to trigger such vulnerabilities through crafted web content aligned with ATT&CK techniques related to client-side exploitation and drive-by attacks.