CVE-2024-10826 Overview
CVE-2024-10826 is a use-after-free vulnerability in the Family Experiences component of Google Chrome on Android. The flaw affects Chrome versions prior to 130.0.6723.116. A remote attacker can trigger heap corruption by serving a crafted HTML page to a targeted user. Google classified the Chromium security severity as High. The weakness is tracked under CWE-416 and requires user interaction to exploit.
Critical Impact
Successful exploitation can lead to heap corruption, enabling potential code execution within the Chrome renderer process on Android devices.
Affected Products
- Google Chrome on Android prior to 130.0.6723.116
- Google Android (Chrome browser component)
- Chromium-based browsers sharing the Family Experiences component
Discovery Timeline
- 2024-11-06 - CVE-2024-10826 published to NVD
- 2025-01-02 - Last updated in NVD database
Technical Details for CVE-2024-10826
Vulnerability Analysis
The vulnerability resides in the Family Experiences feature of Google Chrome on Android. Family Experiences manages supervised user accounts and parental control workflows inside the browser. A use-after-free condition [CWE-416] occurs when the component retains a reference to a heap-allocated object after the object has been freed. When the dangling pointer is later dereferenced, the attacker can manipulate the freed memory region. This manipulation produces heap corruption that an attacker can leverage to influence program flow.
Root Cause
The root cause is improper object lifetime management within the Family Experiences code path. Chrome frees a heap object while another code path still holds a pointer to it. A subsequent operation reuses that pointer, accessing memory that may already contain attacker-controlled data. The Chromium project tracks the underlying bug in Chromium Issue Tracker #370217726.
Attack Vector
The attack vector is network-based and requires user interaction. A remote attacker hosts a crafted HTML page that triggers the vulnerable Family Experiences code path when rendered. The victim must visit the page using a vulnerable Chrome on Android build. No privileges are required prior to exploitation. Successful triggering of the use-after-free corrupts heap metadata or object data, which can be chained with additional primitives to escalate impact within the renderer sandbox.
No public proof-of-concept code or exploit has been observed, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-10826
Indicators of Compromise
- Chrome on Android renderer process crashes referencing Family Experiences or supervised user code paths.
- Unexpected browser tab terminations correlated with visits to untrusted HTML pages.
- Outbound connections from mobile endpoints to newly registered or low-reputation domains hosting crafted HTML payloads.
Detection Strategies
- Inventory Chrome versions across managed Android fleets and flag installations below 130.0.6723.116.
- Correlate browser crash telemetry with URL history to identify suspicious pages targeting Chrome users.
- Monitor mobile threat defense logs for repeated Chrome renderer crashes on the same device.
Monitoring Recommendations
- Ingest Chrome crash and stability telemetry into a centralized logging or SIEM platform for analysis.
- Track Mobile Device Management (MDM) compliance reports for Chrome version drift on Android endpoints.
- Alert on web proxy events showing user navigation to domains flagged by threat intelligence as exploit hosts.
How to Mitigate CVE-2024-10826
Immediate Actions Required
- Update Google Chrome on Android to version 130.0.6723.116 or later through the Google Play Store.
- Enforce auto-update policies for Chrome on managed Android devices using MDM configuration profiles.
- Validate patch deployment by querying installed Chrome versions across the mobile fleet.
Patch Information
Google addressed the issue in the Stable channel update for Chrome 130.0.6723.116. Details are available in the Google Chrome Desktop Update advisory and the corresponding Chromium Issue Tracker #370217726. Administrators should treat the update as mandatory for Android endpoints running Chrome.
Workarounds
- Restrict use of Chrome on Android until the patched build is deployed, routing browsing through a hardened alternative if feasible.
- Block access to untrusted external HTML content using web filtering or DNS protection on mobile devices.
- Disable supervised user or Family Link features on devices that do not require them to reduce exposure to the affected code path.
# Configuration example: query installed Chrome version on Android via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
