EUVD-2026-105684
GHSA-76x9-f6vw-fjr3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Cookies
-
ExecutionReclaim freed object, corrupt memory
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively open attacker-controlled content: a crafted HTML page rendered by Google Chrome for Android on a version prior to 156.0.8078.47 (UI:R user interaction). No authentication or privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined INSIDE the Chrome renderer sandbox - reaching the underlying Android OS or user data outside the browser requires chaining a separate sandbox-escape vulnerability. Patched/updated Chrome builds (>=156.0.8078.47) are not affected. |
| Impact | Signals conflict and must be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) implies a serious remote, unauthenticated flaw requiring only that a victim open a crafted page. However, Google/Chromium rated the issue security severity 'Low', and the description explicitly states code executes INSIDE the sandbox (S:U, no scope change) - a renderer-level compromise that still needs a separate sandbox-escape to reach the device or OS. That gap (external CVSS 'High' vs. vendor 'Low') is the central tension, and the raw 8.8 overstates real-world impact for a sandboxed memory-corruption bug. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or weaponization - this is 'no public exploit identified at time of analysis'. UAF bugs in Chrome are historically exploitable and sometimes chained, but on their own this one is contained by the sandbox. Verdict: patch-worthy given the ubiquitous product and memory-corruption RCE primitive, but NOT an emergency relative to the 8.8 - treat as routine Chrome update priority absent a paired sandbox escape. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an Android Chrome user (version prior to 156.0.8078.47) to open it, e.g. via a link in a message or a malvertising frame. The page manipulates Chrome's Cookies handling to trigger a use-after-free (CWE-416), giving the attacker arbitrary code execution confined to the renderer sandbox. No public exploit code is identified at time of analysis, and full device compromise would require an additional sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page (UI:R). Although the CVSS 3.1 base score is 8.8 and tags include RCE and memory corruption, Google rates the Chromium issue Low because code execution is confined to the renderer sandbox and full device compromise would require chaining a separate sandbox escape. Patch to 156.0.8078.47 or later; no public exploit was identified at time of analysis, and no CISA KEV status was provided.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later via Google Play or managed enterprise distribution, and verify the installed version. Google's stable-channel advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium bug is at https://issues.chromium.org/issues/40061291. No documented workaround fully removes the use-after-free; if immediate update is impossible, reduce exposure by preventing users from opening untrusted HTML links or pages in Chrome for Android, enforcing browser update policies and Safe Browsing, and keeping sensitive data out of the browser profile, with the trade-off that these controls limit attack opportunities but do not patch the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 use-after-free in Chrome's Cookies handling on Android. A freed object remains reachable and can be corrupted via a crafted HTML page, potentially giving an attacker control of renderer memory and arbitrary code execution within the sandbox. The vulnerable surface is Chrome for Android prior to 156.0.8078.47; EUVD identifies that version as the fixed boundary, and no CPE strings were supplied. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable attack requiring no privileges but requiring user interaction; the scope-unchanged rating and Chromium's Low severity are consistent with sandbox-confined impact rather than direct OS compromise.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted HTML is network-delivered (AV:N) and needs a user to open it (UI:R); no privileges (PR:N); execution stays in the sandbox so S:U, with full renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android releases before 156.0.8078.47 contain a memory-corruption flaw that allows a remote attacker to run code inside the browser's renderer sandbox when a user opens a crafted web page. The exposure surface is broad because Chrome is the default browser on most corporate and BYOD Android devices, but Google assesses practical risk as low since the compromise is contained within the sandbox and would require a separate sandbox-escape exploit to affect the device itself. Leadership should treat this as a mobile fleet hygiene issue: the fix is a routine browser update, and any device left unpatched represents an easily closed gap.
Apply vendor patch: Google Chrome for Android 156.0.8078.47 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB