CVE-2026-113293 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2024-9358 represents a critical memory safety flaw within the ANGLE graphics library, which is integrated into Google Chrome on Windows systems prior to version 156.0.8078.47. This issue stems from an improper handling of dynamically allocated memory where a pointer continues to be used after its associated memory has been freed by another part of the application or system routine. In software engineering terms, this is classified as a use-after-free error, which falls under CWE-416 in the Common Weakness Enumeration standard. Such errors occur when an object is deallocated but remains accessible through existing pointers, leading to undefined behavior that can be exploited by malicious actors to compromise application integrity and security boundaries.
The technical mechanism behind this vulnerability involves a scenario where ANGLE processes graphics commands or shader data derived from user input via HTML content. When the browser parses a crafted HTML page containing specific WebGL or canvas elements, it may trigger code paths within ANGLE that allocate memory for rendering contexts or texture buffers. If an attacker can manipulate the timing of these operations or force premature deallocation through malicious script execution, they can cause the application to reference freed memory regions. This state allows the attacker to control what data is written into those reclaimed memory slots, effectively gaining a degree of write-what-where capability within the browser process space.
The operational impact of this vulnerability is severe due to its potential for remote code execution inside the sandboxed environment of Google Chrome. Modern browsers rely heavily on sandboxing techniques to isolate web content from the underlying operating system and user data. However, use-after-free vulnerabilities provide a pathway to escape these restrictions by corrupting internal browser structures such as function pointers or object vtables. By carefully crafting heap contents through repeated allocations and frees, an attacker can overwrite critical control flow data within the ANGLE process. This corruption enables the execution of arbitrary machine code with the privileges granted to the Chrome sandboxed renderer process, which may still offer sufficient access to exploit further system-level vulnerabilities or exfiltrate sensitive user information stored in cookies, local storage, or browser history.
This exploitation vector aligns closely with ATT&CK technique T1203, specifically sub-technique Exploitation for Client Execution, where attackers leverage software vulnerabilities present on client systems rather than servers. The attack chain typically begins with a remote attacker hosting the malicious HTML page and luring a victim to visit it via phishing or compromised websites. Once visited, the browser automatically processes the content without requiring user interaction beyond navigation, triggering the memory corruption flaw in ANGLE. This automatic execution characteristic makes the vulnerability particularly dangerous as it does not rely on social engineering tactics like clicking specific buttons after loading but rather exploits the fundamental parsing and rendering logic of the browser engine itself.
Mitigation for this issue requires immediate updating to Google Chrome version 156.0.8078.47 or later, which includes patches that enforce stricter memory management practices within ANGLE. Developers should ensure that pointers are nullified immediately after deallocation to prevent accidental reuse and implement robust bounds checking during graphics command processing. For end-users, enabling automatic updates ensures timely protection against such high-severity flaws. Additionally, security teams can monitor for indicators of compromise related to unusual network connections originating from Chrome processes or unexpected memory access patterns in endpoint detection systems that track heap corruption events associated with WebGL rendering contexts.