Google Chrome Use-After-Free Vulnerability in Network Component Allowing Heap Corruption

A use-after-free vulnerability has been identified in the Network component of Google Chrome, prior to version 133.0.6943.126. This vulnerability allows remote attackers to potentially exploit heap corruption through a crafted web application. The issue arises when network communication errors occur, leading to improper management of stream closure callbacks, which can be manipulated to cause memory corruption.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, allowing for memory corruption in the V8 JavaScript engine, which could be exploited to execute arbitrary code.

Reproduction

The vulnerability can be reproduced by creating an Isolated Web App that uses the DirectSocket API to open a TCP or UDP socket. After causing a network error that closes the reader stream with an exception, a garbage collection event can be triggered to free the exception object. Once the reader stream is closed, the writer stream can be closed, exposing the now-freed exception to JavaScript, which completes the exploitation process.

Remediation

Users should update to Google Chrome version 133.0.6943.126 or later, where this vulnerability has been fixed.