CVE-2026-113304 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as CVE-2024-9343 represents a critical security flaw within the GPU processing subsystem of Google Chrome on Android, specifically affecting versions prior to 156.0.8078.47. This issue stems from improper memory management practices inherent in how the browser handles graphics rendering tasks delegated to the device's hardware acceleration components. When a user visits a maliciously crafted HTML page containing specially constructed JavaScript and WebGL or Canvas elements, the GPU driver may fail to correctly validate buffer boundaries or handle pointer arithmetic during complex graphical operations. This failure results in a memory corruption state where the application writes data beyond allocated limits or reads from uninitialized memory regions. The severity of this flaw is classified as Medium by Chromium security standards because it primarily facilitates information disclosure rather than immediate code execution, yet its potential to bypass sandboxing mechanisms elevates its risk profile significantly within the context of modern web browsing environments.
From a technical perspective, the core defect lies in the interaction between Chrome’s multi-process architecture and the underlying GPU drivers on Android devices. Modern browsers utilize sandboxes to isolate untrusted content from sensitive system resources and user data. However, when memory corruption occurs during GPU-accelerated rendering, it can lead to out-of-bounds reads that expose contents of adjacent memory blocks. These adjacent blocks may contain sensitive information such as session cookies, authentication tokens, or internal browser state variables that are normally protected by the sandbox boundary. An attacker leveraging this vulnerability does not need direct access to the device but relies on social engineering tactics to lure a victim into loading the exploit code via a website. The crafted HTML page triggers specific rendering paths in the GPU pipeline where memory alignment errors or race conditions allow for unauthorized memory reads, effectively breaking the isolation guarantees provided by the browser’s security model.
The operational impact of this vulnerability is primarily centered on confidentiality and privacy violations rather than system integrity or availability. Successful exploitation allows a remote attacker to read arbitrary memory locations within the Chrome sandbox environment. This capability can be used to extract sensitive user data, including credentials stored in password managers, financial information entered into web forms, or private browsing history details. While the vulnerability does not directly grant code execution privileges on the host operating system, it serves as a powerful primitive for further attacks. For instance, leaked memory contents could facilitate side-channel attacks or provide context necessary to chain with other vulnerabilities for more severe outcomes like remote code execution. The impact is particularly concerning given the widespread use of mobile devices for banking and sensitive communications, where even partial data leakage can lead to significant financial loss or identity theft.
To mitigate this risk, users must ensure their Google Chrome application on Android is updated to version 156.0.8078.47 or later, which contains the necessary patches to correct memory handling routines in the GPU subsystem. Developers and security teams should also enforce strict content security policies for web applications served by internal systems to minimize exposure to untrusted third-party scripts that might attempt such exploits. From a defense-in-depth perspective, enabling hardware-based sandboxing features where available on Android devices can provide an additional layer of protection against memory corruption attacks. Furthermore, organizations should monitor browser update compliance across their mobile device fleets and educate users about the risks of visiting untrusted websites or clicking on suspicious links that may host malicious HTML content designed to trigger such rendering vulnerabilities.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read, as it involves accessing memory beyond allocated boundaries. It also relates to CWE-787 in cases where the corruption leads to unpredictable behavior that could be leveraged for further exploitation. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1059, specifically Command and Scripting Interpreter subcategories if used as part of a broader attack chain, but more accurately maps to data exfiltration techniques such as T1074 or T1005 depending on how the leaked memory is processed. The incident underscores the importance of rigorous code review processes for low-level graphics drivers and browser rendering engines, ensuring that all memory operations are strictly validated against allocated buffer sizes before execution.