CVE-2026-113184 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-9386 represents a critical memory corruption flaw within the scheduling subsystem of Google Chrome, specifically affecting versions prior to 156.0.8078.47. This defect resides in the core engine responsible for managing task execution and resource allocation across browser tabs and worker threads. The severity is classified as low by Chromium security standards due to the complexity required to exploit it successfully within the sandboxed environment, yet its potential impact remains significant because it allows for arbitrary code execution inside a restricted context that typically protects user data from remote attacks.
The technical root cause of this vulnerability lies in improper memory management during the scheduling operations. When processing crafted HTML content, the browser fails to correctly validate or manage pointers associated with scheduled tasks. This oversight leads to conditions such as use-after-free or heap buffer overflow scenarios where memory is accessed after it has been freed or beyond its allocated boundaries. An attacker can leverage this flaw by constructing a malicious webpage that triggers specific scheduling sequences within the renderer process, causing the browser to write data to unintended memory locations or execute code based on corrupted pointers.
From an operational perspective, this vulnerability enables a remote attacker to potentially achieve arbitrary code execution inside the Chrome sandbox. While the sandbox architecture is designed to limit the damage of such exploits by restricting access to sensitive system resources and user files, successful exploitation could still allow for further privilege escalation techniques or lateral movement within the compromised environment. The attack vector is classified as network-based with low complexity, meaning that a victim merely needs to visit a maliciously crafted website hosted on an attacker-controlled server to trigger the exploit without any additional interaction like clicking specific elements or downloading files.
This incident aligns closely with CWE-120 Buffer Copy without Checking Size of Input and CWE-416 Use After Free, which are common categories for memory corruption vulnerabilities in complex software systems. In terms of offensive security frameworks, this vulnerability maps to the ATT&CK technique T1203 Exploitation for Client Execution, where attackers utilize client-side flaws to execute malicious code on a victim's machine. The low severity rating reflects the difficulty of bypassing modern sandbox defenses and mitigations like ASLR and DEP that are enabled by default in Chrome, but it underscores the importance of maintaining up-to-date software versions to prevent potential breaches.
To mitigate this risk, users must upgrade Google Chrome to version 156.0.8078.47 or later immediately upon availability through automatic updates or manual installation packages provided by Google. For enterprise environments, IT administrators should ensure that endpoint management policies enforce timely patching cycles for all browser instances across the organization. Additionally, deploying advanced threat protection solutions that monitor for anomalous memory access patterns in renderer processes can provide an additional layer of defense against exploitation attempts targeting this specific scheduling flaw.