Google Chrome DevTools Use-After-Free Vulnerability Allowing Heap Corruption via Crafted Extension

A use-after-free vulnerability has been identified in the DevTools component of Google Chrome. This issue affects versions prior to 132.0.6834.159 and has been classified as medium severity. The vulnerability allows remote attackers to potentially exploit heap corruption by using a specially crafted Chrome extension.

Impact

Exploitation of this vulnerability leads to memory corruption in the renderer process, which could be exploited to execute arbitrary code.

Reproduction

The vulnerability can be reproduced by creating a Chrome extension that includes a manifest file and a background script. The extension must be loaded into Chrome using the command line, with the 'user-data-dir' option set to a non-existent directory and the 'no-sandbox' option enabled. This allows the extension to run with debugger permissions, triggering the use-after-free condition in DevTools.

Remediation

Users should update to Google Chrome version 132.0.6834.159 or later, where this vulnerability has been fixed.