Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.55
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5877: Use After Free in Navigation
This is a conceptual demonstration.
-->
<html>
<head>
<script>
function trigger_uaf() {
// Create a navigation-related object
let nav_obj = new URL(window.location.href);
// Step 1: Trigger a scenario that might free the object
// In a real vulnerability, specific navigation event triggers this
window.location.hash = "trigger";
// Step 2: Attempt to access the freed object (Use After Free)
// Timing is critical in real exploits
setTimeout(() => {
try {
// Accessing the potentially freed object
console.log(nav_obj.href);
alert("If this crashes or behaves unexpectedly, the vulnerability might be present.");
} catch (e) {
console.error(e);
}
}, 100);
}
window.onload = trigger_uaf;
</script>
</head>
<body>
<h1>CVE-2026-5877 PoC Test</h1>
</body>
</html>