CVE-2026-106310 in Chrome
Summary
by MITRE • 10/06/2026
Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as CVE-2024-6791 represents a resource management flaw within the FontAccess component of Google Chrome, specifically affecting versions prior to 155.0.8059.39. This issue stems from improper handling of released resources during font enumeration and access operations. In modern web browsers, the renderer process is responsible for parsing HTML, executing JavaScript, and rendering visual content. To maintain security isolation, browsers employ a sandboxing model that restricts what code running in the renderer can do with system-level resources. The FontAccess API allows websites to query installed fonts on the user's machine, which has historically been a vector for fingerprinting attacks where attackers identify unique software configurations to track users across different sites without their consent.
The core technical flaw involves a race condition or use-after-free scenario within the font access logic. When a renderer process requests information about system fonts, Chrome allocates specific memory structures and handles to manage this data. If these resources are released prematurely or accessed after they have been deallocated by the browser's internal garbage collection or cleanup routines, it can lead to undefined behavior. In this specific instance, an attacker who had already achieved code execution within a compromised renderer process could exploit this timing discrepancy. By crafting a malicious HTML page that triggers font access operations in a precise sequence, the attacker could manipulate the state of these released resources. This manipulation allows the crafted script to bypass the web origin policy, which is designed to prevent scripts from one domain from accessing data or interacting with elements belonging to another domain.
The operational impact of this vulnerability centers on the erosion of cross-origin isolation guarantees for renderer processes that have been compromised through other means, such as a successful Cross-Site Scripting attack or exploitation of an unrelated rendering bug. While the Chromium security severity is rated as Low because it requires prior compromise of the renderer process, the implications are significant for defense-in-depth strategies. An attacker leveraging this flaw could potentially access sensitive data from iframes hosted on different origins that were previously protected by same-origin policies. This undermines the browser's ability to contain damage within a single tab or frame, allowing lateral movement across origin boundaries and increasing the risk of data exfiltration or session hijacking in environments where multiple third-party scripts are loaded.
From a classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where software continues to use a pointer after it has been freed, leading to unpredictable behavior. It also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, as the bypass enables access to data that should remain isolated by origin policies. In terms of MITRE ATT&CK mapping, this exploit technique falls under T1537, Transfer Data to Cloud Account via Web Service, if used for exfiltration, or more broadly within T1059, Command and Scripting Interpreter, as it facilitates further malicious actions after initial compromise. The vulnerability highlights the complexity of maintaining strict isolation boundaries in complex software like a web browser where multiple subsystems interact dynamically.
Mitigation strategies primarily involve updating to Google Chrome version 155.0.8059.39 or later, which contains patches that correctly manage resource lifecycles within the FontAccess module. For organizations unable to update immediately, implementing strict Content Security Policy headers can help mitigate some risks by restricting script execution and data transfer origins. Additionally, disabling third-party cookies and limiting font access permissions through browser settings can reduce the attack surface for fingerprinting-based exploits. Users should remain vigilant against phishing attempts that might deliver crafted HTML pages designed to trigger such vulnerabilities in older browser versions. Regular patch management remains the most effective defense against these types of logic flaws that rely on precise timing and state manipulation within the rendering engine.