CVE-2026-110166 in Chrome
Summary
by MITRE • 10/13/2026
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as CVE-2024-6345 represents a critical buffer overflow condition within the animation subsystem of Google Chrome, specifically affecting versions prior to 155.0.8059.79. This flaw resides in the core rendering engine responsible for processing CSS and JavaScript-driven animations. The root cause is an improper handling of memory allocation or bounds checking during the manipulation of animation data structures. When a malicious actor constructs a specially crafted HTML page containing optimized, malformed, or excessively large animation parameters, they can trigger an out-of-bounds write operation within the browser's sandboxed environment. This type of error typically occurs when the application fails to verify that input data fits within the allocated memory buffer before copying it, leading to adjacent memory being overwritten with attacker-controlled values.
From a technical perspective, this vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input. The exploitation vector relies on the browser's ability to parse and execute web content from remote sources, making it a classic Remote Code Execution (RCE) scenario. By carefully crafting the payload, an attacker can overwrite critical memory structures such as function pointers or return addresses within the sandboxed process. Although Chrome employs robust security mitigations like ASLR, DEP, and site isolation to limit the impact of exploits, successfully exploiting this buffer overflow allows a remote adversary to bypass these protections and execute arbitrary code with the privileges of the browser's renderer process. The Chromium project has assigned this issue a High severity rating due to its potential for widespread exploitation through standard web browsing activities without requiring user interaction beyond visiting a malicious site.
The operational impact of this vulnerability is severe, as it enables full remote code execution on the victim's machine under certain conditions. An attacker could use this flaw to install malware, steal sensitive data such as cookies and session tokens, or pivot further into internal networks if the browser has access to local resources. The threat landscape for Chrome users remains significant because animation features are ubiquitous in modern web applications, meaning that even legitimate-looking websites with complex UI elements could potentially be weaponized if compromised by a third-party ad network or malicious script injection attack. Users running affected versions of Google Chrome are at immediate risk when navigating untrusted or poorly secured web content that utilizes advanced CSS transitions or JavaScript animation libraries.
To mitigate this vulnerability, organizations and individual users must ensure that their browsers are updated to version 155.0.8059.79 or later immediately upon availability. This update contains the necessary patches for memory management routines within the animation module to enforce strict bounds checking. In environments where immediate patching is not feasible due to compatibility concerns, network-level security controls such as Web Application Firewalls (WAF) and advanced endpoint detection and response systems should be configured to detect and block traffic patterns associated with known exploitation techniques targeting browser rendering engines. Additionally, enabling sandboxed iframes for third-party content can help contain the blast radius of any successful exploit attempt by isolating potentially malicious scripts from accessing sensitive local resources or other tabs within the same user session.