Loading story…
Researchers detailed two Chrome renderer exploitation chains that turned memory-corruption flaws into remote code execution from malicious web content. One write-up analyzed CVE-2020-15972, a use-after-free in Chrome's WebAudio component on Android, where removal of a mutex during orphaned AudioHandler cleanup let the audio processing thread access freed memory. The bug could be triggered through AudioWorkletNode and ScriptProcessorNode, enabling an out-of-bounds read for information disclosure, ASLR bypass, and eventual control of a virtual function call inside the renderer.
A separate analysis showed how the libwebp bug's limited 4-byte out-of-bounds write in Chrome Blink could be weaponized into full renderer RCE by abusing Chromium heap behavior. The researchers used CSSVariableData and PartitionAlloc ThreadCache placement to convert the write into a use-after-free, reclaimed the freed object with AudioArray to gain a heap out-of-bounds read, and then forged an HRTFPanner object to execute attacker-controlled code on Chromium running Ubuntu 22.04. Together, the reports show how attackers can chain information disclosure, allocator manipulation, and object corruption inside the Chrome renderer, while Google had already patched the WebAudio flaw in Chrome 86.0.4240.75.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
DARKNAVY published a technical write-up describing how a Chrome renderer libwebp out-of-bounds write could be turned into a CSSVariableData use-after-free, an AudioArray-based infoleak, and ultimately code execution via a forged HRTFPanner object.
GitHub Security Lab published a detailed analysis of exploiting CVE-2020-15972 from a malicious website to achieve remote code execution in the Chrome renderer on Android as part of a larger exploit chain.
Google fixed the Chrome WebAudio renderer remote code execution vulnerability CVE-2020-15972 in Chrome version 86.0.4240.75. The write-up states this occurred in October 2020.
The Chrome WebAudio use-after-free tracked as CVE-2020-15972 was reported in September 2020 as bug 1125635 and was treated as a duplicate of bug 1115901.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2023-3079` enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to `JSStrictArgumentsObject`, where the `StoreFastElementIC_GrowNoTransitionHandleCOW` handler could grow an elements backing store without changing the object from `PACKED_ELEMENTS` to `HOLEY_ELEMENTS`, creating an inconsistent internal state. That inconsistency exposed V8’s internal **"The Hole"** value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for `addr_of` and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Jul 24, 2026
A flaw in Chrome's V8 JavaScript engine, tracked as **`CVE-2021-38003`**, exposed the internal **`TheHole`** value to attacker-controlled script code in Chromium-based browsers before **`95.0.4638.69`**. The bug stemmed from exception handling in **`JSON.stringify()`**, where an overflow path in `JsonStringifier::SerializeArrayLikeSlow()` could return an exception state without setting `pending_exception`, allowing later exception handling to retrieve an uninitialized value and leak `TheHole` into JavaScript. Researchers showed the leak could be turned into a full renderer compromise by abusing `TheHole` to corrupt a JavaScript `Map`'s state, gain out-of-bounds access, and build **addrof**, heap read/write, and arbitrary write primitives. The exploit chain then disabled Chromium's **wasm-memory-protection-keys** mitigation, wrote shellcode into a WebAssembly RWX page, and executed it to achieve renderer remote code execution. Google patched the issue by preventing fetches of an empty `pending_exception` and later added hardening to block `TheHole`-based `Map` deletion abuse; the vulnerability had also been reported as exploited in the wild.
Jun 29, 2026
Google has patched **CVE-2026-11645**, an actively exploited flaw in Chrome’s V8 JavaScript and WebAssembly engine that can give attackers both out-of-bounds read and write capabilities from a crafted web page. The bug affects Chrome prior to **149.0.7827.103** on Windows and macOS and **149.0.7827.102** on Linux, creating a realistic drive-by compromise path in which renderer-process code execution could be chained with a sandbox escape for full device takeover. Public reporting notes that Google confirmed in-the-wild exploitation but did not disclose the campaign, attribution, or full exploit chain. The risk is amplified across the broader Chromium ecosystem because many **Electron** and Chromium-based applications ship their own embedded V8 runtimes and may remain vulnerable after browser updates. Historical Chromium issues and research around **XSS Auditor** and Chrome security bugs—including bypasses, cross-origin data extraction, form-data leakage through redirects, and Egor Homakov’s account of abusing Chrome bugs in an OAuth flow—underscore how browser flaws can expose sensitive data or be combined into larger attack chains. Organizations are being pushed to update Chrome immediately and inventory Chromium-derived applications that may require separate patch cycles.
Aug 16, 2026