CVE-2026-95311 in Chrome
Summary
by MITRE • 09/29/2026
Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2025-6961 represents a critical memory safety flaw within the font rendering subsystem of Google Chrome, specifically affecting versions prior to 154.0.8037.57. This issue is classified under CWE-122, which denotes heap-based buffer overflow or out-of-bounds write operations that occur outside the intended memory allocation boundaries. In this specific instance, the flaw manifests as a free of non-heap memory error within the Fonts module. The underlying technical mechanism involves improper handling of font data structures where the application attempts to deallocate memory regions that were not originally allocated on the heap or are managed by different lifecycle mechanisms. This mismanagement leads to undefined behavior during garbage collection or explicit cleanup routines, potentially corrupting internal state variables and control flow pointers within the browser engine.
From an operational perspective, this vulnerability allows a remote attacker to achieve arbitrary code execution with significant severity implications due to its potential for sandbox escape. The attack vector relies heavily on social engineering tactics, requiring the victim to visit a specially crafted HTML page that triggers the malformed font processing logic. Once triggered, the memory corruption can be exploited to overwrite critical function pointers or return addresses in adjacent memory regions. This exploitation path enables the attacker to redirect execution flow into malicious shellcode injected via the crafted web content. The severity is rated as Medium by Chromium security standards because while it requires user interaction and a specific environment setup, its ability to break out of Chrome's sandbox isolation model makes it particularly dangerous for enterprise environments where browser-based attacks are common entry points for broader network compromise.
The exploitation of this vulnerability aligns with several tactics defined in the MITRE ATT&CK framework. Specifically, it relates to T1059 Command and Scripting Interpreter through the execution of arbitrary code derived from web content. Furthermore, because the attack leverages a crafted HTML page delivered via a website or email attachment, it falls under T1189 Drive-by Compromise. The sandbox escape aspect is particularly concerning as it bypasses Chrome's multi-process architecture protections, which are designed to contain damage within individual renderer processes. By escaping this isolation, an attacker gains the ability to interact with system-level APIs and potentially escalate privileges or install persistent malware on the host machine without further user interaction after the initial visit.
Mitigation strategies for this vulnerability primarily involve immediate patching of the Google Chrome browser to version 154.0.8037.57 or later, where these memory management issues in the font handling subsystem have been resolved through stricter validation and proper allocation tracking. Organizations should enforce automatic update policies to ensure all endpoints are protected against such zero-day style exploits that leverage social engineering. Additionally, implementing strict content security policies can help mitigate the impact by restricting script execution from untrusted sources, although this is less effective if the attacker successfully escapes the sandbox. Security teams should also monitor for indicators of compromise related to unusual font processing activity or unexpected network connections originating from browser processes, which may signal active exploitation attempts targeting older versions of Chrome before patches are applied.