CVE-2026-95353 in Chrome
Summary
by MITRE • 09/29/2026
Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a use-after-free error within the JavaScript bindings of Google Chrome prior to version 154.0.8037.57 represents a critical memory management flaw that undermines the browser's sandboxing mechanisms. This specific class of defect occurs when the application continues to reference a memory block after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this context, the bindings serve as the interface between the high-level JavaScript engine and lower-level system resources or native code components. When an object is deallocated but remains accessible through lingering pointers within these binding layers, an attacker who controls the input data can manipulate how subsequent operations interact with that freed memory region.
The operational impact of this vulnerability is severe due to its potential for remote code execution inside the browser's sandbox environment. By crafting a specific HTML page containing malicious JavaScript and embedded exploit payloads, an attacker can trigger the premature deallocation of critical objects while maintaining references to them. Through careful timing and heap manipulation techniques, such as heap grooming or spray attacks, the adversary can cause the freed memory to be reallocated for their own purposes. This allows the execution of arbitrary code within the context of the browser process, effectively bypassing security boundaries that are designed to isolate web content from the underlying operating system. The Chromium project has classified this issue with a medium severity rating, reflecting its potential for exploitation but also acknowledging the existing mitigations such as sandboxing and heap hardening features present in modern browsers.
From a classification perspective, this vulnerability aligns closely with CWE-416, which describes Use After Free conditions where memory is accessed after it has been released to the system. This error type is frequently associated with CWE-787, an out-of-bounds write or read scenario that arises when invalid pointers are dereferenced. In terms of offensive security frameworks, this exploit vector maps directly to MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution. The attack relies on social engineering elements such as a crafted HTML page delivered via phishing links or compromised websites to lure users into triggering the vulnerability without their knowledge.
Mitigation strategies primarily involve updating Google Chrome to version 154.0.8037.57 or later, where these memory management issues have been addressed through code patches that ensure proper reference counting and nullification of pointers after deallocation. For organizations managing large deployments, enforcing automatic update policies is essential to minimize the window of exposure. Additionally, security teams should monitor for indicators of compromise related to browser-based exploits, including unusual network traffic patterns originating from web browsers or unexpected process spawns following user interaction with suspicious content. Implementing application whitelisting and restricting script execution in untrusted zones can further reduce the attack surface by limiting the ability of malicious scripts to interact deeply with system resources even if a vulnerability is present.