CVE-2026-95366 in Chrome
Summary
by MITRE • 09/29/2026
Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as CVE-2024-9681 represents a critical failure in resource management within the Google Chrome browser engine, specifically affecting versions prior to 154.0.8037.57. This flaw is categorized under CWE-404, which describes improper shutdown or release of system resources, and more critically, it facilitates an escape from the sandboxed environment that protects user data. The core issue lies in how the browser handles memory allocation and deallocation during the rendering process. When a renderer process manages dynamic resources such as JavaScript objects, DOM elements, or network connections, it must strictly adhere to lifecycle protocols to ensure isolation between different web origins. In this instance, the implementation failed to properly synchronize resource release with security checks, allowing an attacker who had already achieved code execution within a compromised renderer process to manipulate these freed memory regions.
The operational impact of this vulnerability is significant because it undermines the fundamental principle of origin separation that defines modern browser security models. Web origins are designed to prevent malicious scripts from one website from accessing sensitive data or performing actions on behalf of another site, such as banking portals or email services. By exploiting the use-after-free condition in the core rendering engine, an attacker can craft a specific HTML page containing malicious JavaScript that triggers this flaw. Once triggered, the attacker gains the ability to read and potentially modify memory belonging to other processes or contexts within the browser session. This effectively allows for cross-origin data theft, where sensitive information like cookies, local storage contents, or authentication tokens from unrelated websites can be exfiltrated by the compromised renderer process.
From a threat actor perspective, this vulnerability aligns with ATT&CK technique T1059.007, which covers JavaScript execution within browser environments, and specifically relates to privilege escalation tactics where an attacker moves from a low-privilege sandboxed context to one with broader access rights. The severity is rated as medium by the Chromium security team because while it requires initial compromise of the renderer process, this condition can be achieved through various common attack vectors such as drive-by downloads or malicious advertisements. Once inside the renderer, the ability to bypass origin policies transforms a contained script execution into a full session hijacking scenario. This means that even if the user does not directly interact with the malicious page beyond visiting it, the browser's internal state can be manipulated to steal credentials from other open tabs or services accessed during the same browsing session.
Mitigation strategies for this vulnerability primarily involve immediate software updates. Users and system administrators must ensure that Google Chrome is updated to version 154.0.8037.57 or later, where these resource management checks have been hardened. For organizations deploying browsers at scale, enforcing automatic update policies through endpoint management solutions is essential to minimize the window of exposure. Additionally, while technical patches are the primary defense, users should remain vigilant against visiting untrusted websites and consider using browser extensions that restrict script execution on high-risk domains. Security teams should also monitor for indicators of compromise related to renderer process anomalies or unexpected network connections originating from background processes, as these may signal active exploitation attempts targeting this specific flaw before patching is complete.