CVE-2026-118352 in Chrome
Summary
by MITRE • 10/28/2026
Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as CVE-2024-9038 represents a critical memory corruption flaw within the cache subsystem of Google Chrome, specifically affecting versions prior to 156.0.8078.73. This defect arises from improper handling of data structures during caching operations, where the browser fails to correctly validate or manage memory boundaries when processing crafted web content. The root cause is classified under CWE-122, which denotes a heap-based buffer overflow, indicating that an attacker can write beyond the allocated bounds of a heap object. This type of error typically occurs due to insufficient checks on input data length or incorrect pointer arithmetic during cache entry creation or retrieval processes within the Chromium engine.
The operational impact of this vulnerability is severe because it allows for remote code execution with elevated privileges relative to the browser sandbox environment. By hosting a specially crafted HTML page, an attacker can trigger the memory corruption flaw when a victim visits the site using the affected version of Chrome. The exploitation chain likely involves manipulating cache entries to overwrite adjacent memory structures or function pointers, thereby gaining control over program flow. Although modern browsers employ robust sandboxing mechanisms designed to limit the damage of such exploits by restricting access to system resources and other processes, successful exploitation in this context suggests that the attacker may be able to escape these restrictions or execute arbitrary code within the limited scope of the renderer process before containment measures can intervene.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1203, which covers Exploitation for Client Execution, as it relies on user interaction via a malicious webpage. It also relates to T1059, Command and Scripting Interpreter, if the executed code leads to further system compromise. The high severity rating assigned by Chromium security teams reflects the potential for significant unauthorized access and data exfiltration should an attacker successfully leverage this flaw in conjunction with other vulnerabilities or social engineering tactics.
Mitigation strategies primarily involve immediate software updates. Administrators and end-users must upgrade Google Chrome to version 156.0.8078.73 or later, where the memory management logic within the cache subsystem has been corrected to prevent out-of-bounds writes. In environments where patching is not immediately feasible, network-level controls such as web filtering proxies can be configured to block access to known malicious domains hosting exploit kits. Additionally, enabling strict content security policies and disabling unnecessary browser features like JavaScript or plugins on untrusted sites can reduce the attack surface available for triggering this memory corruption flaw. Regular monitoring of vulnerability databases and maintaining an up-to-date patch management cycle are essential practices to defend against such high-severity client-side vulnerabilities.