CVE-2026-95351 in Chrome
Summary
by MITRE • 09/29/2026
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability described constitutes a critical use-after-free flaw within the Views component of Google Chrome, specifically affecting versions prior to 154.0.8037.57. This memory corruption issue arises when the application continues to reference a pointer after the memory it points to has been freed and potentially reallocated for other purposes. In the context of web browsers, such flaws are particularly dangerous because they can be triggered by maliciously crafted HTML pages or scripts loaded from remote servers. The core technical failure lies in the improper management of object lifecycles within the rendering engine's user interface layer, where a pointer to an already destroyed Views object is accessed during subsequent operations. This access leads to undefined behavior, which attackers can exploit to manipulate memory structures and achieve arbitrary code execution.
The operational impact of this vulnerability is severe due to its potential for sandbox escape. While Chrome employs a multi-process architecture with strict sandboxes to limit the damage caused by compromised renderer processes, a use-after-free in the Views component allows an attacker who has already gained control over the renderer process to break out of that isolation boundary. By carefully crafting the exploit payload, an adversary can overwrite critical data structures or hijack control flow mechanisms within the browser's main process or other privileged components. This effectively neutralizes the security sandbox, granting the attacker full access to the underlying operating system with the privileges of the user running the browser. Consequently, this enables a wide range of malicious activities including installation of malware, theft of sensitive data such as credentials and cookies, and establishment of persistent backdoors on the victim's machine.
From a classification perspective, this vulnerability aligns closely with CWE-416, which defines use-after-free errors where memory is accessed after it has been freed. The exploitation technique leverages the ATT&CK tactic of Defense Evasion by bypassing sandbox restrictions to execute code in a more privileged context. This specific attack vector falls under the sub-tactic of Sandbox Escape within the Execution and Persistence techniques documented in the MITRE ATT&CK framework for enterprise environments. Understanding these mappings is crucial for security teams as it highlights not just the memory safety issue but also the broader implications for endpoint protection strategies that rely on process isolation to contain threats.
Mitigation requires immediate action by updating Google Chrome to version 154.0.8037.57 or later, where this specific use-after-free condition in the Views component has been addressed through improved memory management and pointer validation checks. Organizations should enforce automated update policies across all endpoints to ensure that users are protected against such zero-day style exploits as soon as patches become available. Additionally, deploying endpoint detection and response solutions with behavioral analysis capabilities can help identify attempts to exploit renderer process compromises for sandbox escapes. Security administrators should also consider implementing strict content security policies and restricting the execution of untrusted scripts where possible to reduce the attack surface presented by malicious web pages attempting to trigger such memory corruption vulnerabilities.