CVE-2026-113204 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-9353 represents a critical memory safety flaw within Google Chrome for Android, specifically affecting versions prior to 156.0.8078.47. This issue is classified as an out-of-bounds write or use-after-free condition located in the Trusted Web Activities component of the Chromium engine. The vulnerability arises from improper management of object lifecycles within the browser's rendering and navigation subsystems, where a pointer to a memory location remains valid for access even after that memory has been deallocated by the system. This type of error is particularly dangerous because it allows an attacker to manipulate how the browser interprets freed memory, potentially leading to arbitrary code execution if the attacker can control the data written into that reclaimed space before it is reallocated for a different purpose.
From a technical perspective, this flaw falls under the Common Weakness Enumeration category CWE-416, which defines use-after-free vulnerabilities. In the context of web browsers, such flaws are often exploited through complex interactions between JavaScript execution and native C++ code within the browser engine. An attacker crafts a malicious HTML page that triggers specific navigation or activity transitions in Trusted Web Activities. When this crafted content is processed by Chrome on Android, it causes the application to access memory that has already been freed. By carefully timing the allocation of new objects into that same memory address, an attacker can overwrite critical data structures, such as function pointers or object vtables, thereby gaining control over the program's execution flow.
The operational impact of this vulnerability is severe due to its potential for remote code execution within a sandboxed environment. Although Chrome employs multiple layers of security mitigations, including sandboxing and address space layout randomization, successful exploitation can allow an attacker to bypass these protections and execute arbitrary commands on the victim device. Since Trusted Web Activities are designed to bridge web content with native Android applications, compromising this component could potentially lead to privilege escalation or access to sensitive user data stored by associated apps. The Chromium security team has rated this issue as medium severity, reflecting its potential for exploitation but also acknowledging the existing mitigations that make successful attacks difficult in typical scenarios without additional social engineering or specific browser configurations.
This vulnerability aligns with several tactics and techniques from the MITRE ATT&CK framework, particularly those related to initial access and execution via web-based vectors. Attackers typically distribute such malicious HTML pages through phishing campaigns, compromised websites, or drive-by download mechanisms. Once a user visits the crafted page on their Android device using an affected version of Chrome, the exploit code runs automatically in the background without requiring further interaction from the victim. This automated nature makes it a significant threat for large-scale attacks targeting mobile users who may not be aware they are interacting with malicious content.
To mitigate this risk, organizations and individual users must ensure that Google Chrome on Android is updated to version 156.0.8078.47 or later immediately upon availability. Software vendors typically release patches for such vulnerabilities promptly after discovery to minimize the window of exposure. Additionally, security teams should enforce strict content security policies and utilize browser hardening techniques where possible. Users are advised to exercise caution when visiting untrusted websites and to keep their operating systems and applications up to date with the latest security patches provided by Google. Regular monitoring for unusual device behavior or performance anomalies can also help in detecting potential exploitation attempts, although proactive patching remains the most effective defense against this class of memory corruption vulnerabilities.