EUVD-2026-105603
GHSA-xvpf-35h7-fv8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted web page
-
ExploitDeliver malicious HTML to Omnibox
-
ExecutionTrigger memory corruption (CWE-119)
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in Google Chrome on Android (UI:R - user interaction via visiting a crafted HTML page); no authentication or prior privileges are needed (PR:N). The key limiting factor is that code execution is confined to the renderer sandbox (S:U) - this CVE alone does not grant host/device compromise, so full exploitation would realistically require chaining with a separate sandbox-escape vulnerability. Affected builds are Chrome prior to 156.0.8078.47; updating to that version or later removes the condition. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) indicates a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page - a trivially achievable condition for a mobile browser. However, this High CVSS conflicts with two tempering signals: Google rated the Chromium security severity as Medium, and the description explicitly scopes code execution to 'inside the sandbox,' meaning this is a memory-corruption primitive confined to the renderer with no stated sandbox escape - consistent with the S:U (scope unchanged) metric. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely patchable, broadly-reachable browser bug worth prioritizing for a product with massive deployment, but realistic single-CVE impact is limited by the sandbox boundary (it would typically need chaining with a sandbox-escape bug for full device compromise), which reconciles the 8.8 CVSS with Google's Medium rating. Note also a data discrepancy: the description states 'on Android,' yet the linked advisory URLs reference a 'stable-channel-update-for-desktop' page - verify the affected platform with the vendor advisory. |
| Exploit ScenarioDerived | A remote attacker hosts or injects a crafted HTML page (e.g., via a malicious link, ad, or compromised site) that triggers the Omnibox memory-corruption bug when rendered in Chrome for Android. The victim need only visit the page (UI:R), after which the attacker can execute arbitrary code within the renderer sandbox. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Chrome for Android's Omnibox prior to 156.0.8078.47 can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 8.8 High with user interaction required (UI:R), but scope is unchanged (S:U), so this flaw alone does not provide host or device compromise; chaining with a separate sandbox escape would be needed for that. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
RemediationAI
Vendor-released patch: 156.0.8078.47. Update Chrome for Android to 156.0.8078.47 or later through Google Play or a managed Play Store, and verify the installed version after updating; the stable-channel advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue is at https://issues.chromium.org/issues/541604102. If immediate update enforcement is not possible, restrict Chrome for Android to trusted sites through Android Enterprise allowlisting or managed configurations, or route untrusted browsing to a separately maintained browser, accepting reduced usability and incomplete coverage; disabling JavaScript is not a reliable mitigation for a memory-corruption flaw and would break many sites. Prioritize devices that routinely load untrusted web content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, which is a memory-safety defect in the Omnibox component of Chrome for Android that can be reached through attacker-controlled HTML content. Because Chrome uses a multi-process architecture, successful exploitation yields code execution constrained by the renderer sandbox; the supplied CVSS vector keeps scope unchanged (S:U), so this CVE is not a direct sandbox escape. Google's Chromium security severity is Medium while the supplied CVSS 3.1 base is 8.8 High, reflecting different scoring contexts. Affected builds are Chrome for Android before 156.0.8078.47, and the EUVD entry corroborates that fixed baseline; no CPE strings were provided in the input.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to load it (UI:R); arbitrary code in the renderer stays within the sandbox, so scope unchanged (S:U) with high C/I/A on that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
A memory-corruption flaw in Chrome for Android's Omnibox (CVE-2026-113032) lets a crafted web page run attacker code inside the browser sandbox on unpatched devices, and Google has released Chrome 156.0.8078.47 as the fix. Because web browsing is a constant activity across the Android-equipped workforce, nearly every mobile user is a potential entry point, although the flaw is contained within the browser sandbox and would require a separate escape to reach corporate data or the device itself. No public exploit code has been identified at time of analysis, making this a patch-cadence and mobile fleet hygiene issue rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB