CVE-2026-95313 in Chrome
Summary
by MITRE • 09/29/2026
Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2024-6953 represents a critical memory corruption flaw within the Fullscreen component of Google Chrome prior to version 154.0.8037.57. This issue is classified technically as an out-of-bounds write, which manifests in practice through use-after-free semantics where the browser fails to properly manage the lifecycle of objects associated with fullscreen mode operations. The root cause lies in a race condition or improper state management during the transition between different display modes, specifically when handling window geometry and rendering contexts. An attacker can exploit this by crafting an HTML page that triggers specific JavaScript events related to full-screen API calls while simultaneously manipulating DOM elements or iframe states. This manipulation causes Chrome to release memory associated with certain internal structures before they are fully dereferenced in subsequent operations, leading to a situation where the application writes data to freed heap memory.
From a technical perspective, this flaw aligns closely with CWE-416, Use After Free, and often intersects with CWE-787, Out-of-bounds Write, depending on how the attacker controls the overwritten memory contents. The severity is rated as Critical by Chromium security standards because it allows for arbitrary code execution outside of Chrome's sandbox boundaries. Modern browsers rely heavily on multi-process architecture and sandboxes to limit the impact of a successful exploit. However, when an out-of-bounds write occurs in a privileged process or within shared memory regions that are not strictly isolated, an attacker can gain control over critical pointers such as function tables or object headers. By carefully crafting the payload written into the freed memory region, the attacker can redirect execution flow to shellcode injected via other vectors, thereby achieving arbitrary code execution with elevated privileges relative to the sandboxed renderer process.
The operational impact of this vulnerability is severe for end-users and enterprise environments alike. A successful exploitation allows a remote attacker to execute arbitrary commands on the victim's machine simply by convincing them to visit a malicious website or opening a phishing email containing an embedded crafted HTML page. This bypasses many traditional security controls because the exploit operates within the context of the browser process, which often has access to local files and network resources depending on user permissions. Furthermore, since this is a memory corruption vulnerability, it may be difficult to detect through standard signature-based intrusion detection systems unless behavioral analysis tools are deployed that monitor for anomalous heap operations or sandbox escapes. The ability to execute code outside the sandbox means the attacker can potentially install malware, exfiltrate sensitive data such as cookies and session tokens, or pivot further into internal networks if the user has access to them through browser extensions or local applications linked via protocol handlers.
Mitigation strategies primarily involve immediate patching of the Google Chrome installation to version 154.0.8037.57 or later where these memory management issues have been resolved by ensuring proper reference counting and nullifying pointers after deallocation. Organizations should enforce automated update policies for all endpoints running Chrome to minimize exposure windows. In addition to patching, defense-in-depth measures are recommended. Users should disable JavaScript on untrusted sites using browser extensions like NoScript or configure enterprise policy settings that restrict full-screen API access where not strictly necessary. Network security teams can implement web filtering solutions that block known malicious domains and analyze traffic for patterns indicative of exploit kits attempting to leverage memory corruption vulnerabilities. Endpoint detection and response systems should be tuned to monitor for suspicious process creation events originating from browser processes, particularly those involving script hosts or dynamic link library injections which are common post-exploitation techniques following a sandbox escape.