CVE-2026-113098 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-9345 represents a critical memory corruption flaw within the CacheStorage component of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This defect is classified under CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, indicating that the software fails to properly validate data boundaries when handling cached web content. The root cause lies in how Chrome processes and manages memory allocations for cache entries during rendering operations. When an attacker constructs a malicious HTML page containing specially crafted scripts or embedded resources, they can trigger an out-of-bounds write operation within the CacheStorage module. This improper boundary check allows the application to overwrite adjacent memory locations that are not intended to be modified by the current execution context.
The operational impact of this vulnerability is severe due to its potential for remote code execution and information disclosure through sandbox escape techniques. Although Chrome employs a multi-process architecture with strict sandboxing to limit the damage caused by compromised renderer processes, this specific flaw enables an attacker to bypass these protections. By exploiting the memory corruption within CacheStorage, a remote attacker can manipulate internal data structures such as function pointers or virtual table entries. This manipulation facilitates arbitrary code execution in the context of the browser process rather than being confined to the restricted sandboxed environment. Consequently, the attacker gains elevated privileges that allow them to read sensitive information from protected memory regions, potentially exposing cookies, session tokens, and other confidential user data stored within the browser's secure storage areas.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1203 Exploitation for Client Execution, where attackers leverage software vulnerabilities to execute malicious payloads on victim systems without direct interaction beyond visiting a webpage. The ability to read memory inside the sandbox also correlates with data exfiltration techniques described in T1567 Exfiltration Over Web Service or similar mechanisms depending on how the stolen data is transmitted back to the attacker's infrastructure. The severity rating of High by Chromium security teams reflects the realistic exploitability and significant impact on confidentiality and integrity, as successful exploitation compromises the fundamental trust model of the web browser environment.
Mitigation strategies primarily involve immediate software updates to ensure that all instances of Google Chrome are upgraded to version 156.0.8078.47 or later, where these memory management checks have been hardened. Organizations should enforce automated update policies for endpoint devices to minimize exposure windows. Additionally, security administrators can implement content security policies and sandboxing configurations at the network level to restrict access to untrusted web resources. User education regarding phishing risks remains crucial since this vulnerability requires a user to visit a crafted HTML page or interact with malicious content hosted on compromised websites. Regular patch management cycles are essential to address such high-severity vulnerabilities promptly before they can be widely exploited in the wild by threat actors seeking to establish persistent access or steal sensitive credentials from corporate networks.