CVE-2026-113144 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-9386 represents a critical memory corruption flaw within the Speech component of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This defect allows for an out-of-bounds read operation when processing speech-related data structures. The root cause lies in improper bounds checking during the handling of audio or voice input streams, where the application fails to validate that memory access requests remain within the allocated buffer boundaries. When a crafted HTML page triggers this code path with maliciously constructed parameters, it forces the browser engine to read from memory locations adjacent to the intended target buffer. This type of error is classically categorized under CWE-125, which denotes Out-of-bounds Read vulnerabilities, indicating that the software reads data past the end or before the beginning of a designated buffer without proper validation of input indices.
The operational impact of this vulnerability extends beyond simple application instability due to its potential for information disclosure. Because Google Chrome employs a multi-process architecture with strict sandboxing mechanisms designed to isolate web content from sensitive system resources, an attacker cannot directly execute arbitrary code or gain full control over the host operating system through this flaw alone. However, by reading memory inside the sandbox, an attacker can potentially extract sensitive data such as session cookies, authentication tokens, private keys, or other confidential information stored in browser memory. This capability effectively bypasses some of the security boundaries intended to protect user privacy and integrity. The Chromium project has classified this issue with a Medium severity rating, reflecting its potential for exploitation while acknowledging that it does not directly lead to remote code execution without additional vulnerabilities being chained together.
From an offensive security perspective, this vulnerability aligns with techniques observed in advanced persistent threat campaigns where initial access is gained through social engineering or drive-by downloads involving crafted web pages. The attack vector corresponds to ATT&CK technique T1059, specifically the use of HTML scripting for execution, and leverages memory corruption primitives often associated with data exfiltration strategies like T1005, which involves local data collection from compromised systems. While the sandbox provides a robust layer of defense against direct exploitation, sophisticated attackers may combine this out-of-bounds read with other vulnerabilities to achieve arbitrary code execution or escape the sandbox environment entirely. The existence of such flaws highlights the complexity of maintaining memory safety in large-scale software projects and underscores the importance of rigorous input validation within high-level application components like speech processing modules.
Mitigation for this vulnerability requires immediate action by users and administrators to update Google Chrome to version 156.0.8078.47 or later, where these bounds checking mechanisms have been corrected. Organizations should enforce automated patch management policies to ensure that all client endpoints are updated promptly upon the release of security patches. Additionally, defense-in-depth strategies such as enabling site isolation features and restricting permissions for speech-related APIs can reduce the attack surface available to potential attackers. Security teams should also monitor network traffic for unusual data exfiltration patterns that might indicate successful exploitation attempts in environments where patching cannot be applied immediately. Continuous monitoring and adherence to industry standards like CWE classifications help in understanding the nature of such flaws and implementing appropriate technical controls to mitigate risks associated with memory corruption vulnerabilities.