EUVD-2026-105669
GHSA-6f7r-64vm-8rcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malformed Text content
-
ExploitTrigger memory corruption in renderer
-
ExecutionExecute arbitrary code in sandbox
-
ImpactAttempt chained sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively open an attacker-controlled crafted HTML page in Google Chrome for Android on a version prior to 156.0.8078.47 (UI:R user interaction is the primary limiting factor; no authentication or special configuration is needed, PR:N). Successful exploitation yields code execution confined to the renderer sandbox (Scope:Unchanged), so full device compromise is LIMITED unless chained with a separate sandbox-escape vulnerability. Chrome's automatic update mechanism further limits the realistic exposure window on managed/consumer devices. |
| Impact | Signals are mostly consistent toward a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 (High) and indicates a remote, low-complexity, unauthenticated attack that requires user interaction - the victim must open a crafted HTML page. A notable conflict exists: Google/Chromium rated this 'Medium' severity, whereas the NVD-style CVSS base score is 8.8 (High); this divergence is largely explained by the description stating code execution occurs INSIDE the Chrome sandbox (Scope:Unchanged), meaning a second sandbox-escape bug would be needed for full host compromise - so the real-world impact is more contained than the 8.8 suggests. No EPSS score was supplied, no CISA KEV listing is present, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-management priority given Chrome's enormous footprint and auto-update cadence, but not a drop-everything emergency absent exploitation evidence. Missing data to verify: EPSS probability and any POC status are absent and should be monitored. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed Text-rendering content and lures an Android Chrome user to visit it (via link, ad, or malvertising). When the page renders, the memory-corruption flaw in the Text component is triggered, allowing arbitrary code execution within the renderer sandbox. No public proof-of-concept is referenced, and full device compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Remote code execution in Google Chrome on Android before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 8.8 rating reflects high confidentiality, integrity, and availability impact, but Scope:Unchanged means the compromise is confined to the browser sandbox unless chained with a separate sandbox-escape vulnerability. Google has released a fixed build, and no public exploit was identified at time of analysis.
RemediationAI
Upgrade Google Chrome on Android to 156.0.8078.47 or later; Google shipped the vendor-released patch in the stable-channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Managed fleets should use Chrome Browser Cloud Management or Android EMM policies to enforce the minimum version and verify installation, because relying only on automatic updates can leave exposure gaps. If immediate upgrading is not possible, reduce exposure by preventing users from opening untrusted HTML pages in Chrome through URL filtering or a managed browser, and consider disabling JavaScript as a partial attack-surface reduction, though that can break sites and is not a guaranteed fix; the renderer sandbox limits the direct impact, so patching remains the priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-119 improper restriction of operations within the bounds of a memory buffer in Chromium's Text component, which handles text layout and rendering for HTML content in Google Chrome on Android. A crafted HTML page can trigger memory corruption in the renderer process; the CVSS vector shows PR:N and UI:R, so the attacker needs no credentials but must convince the user to load the page. Because Scope is Unchanged and Chrome's renderer sandbox constrains the renderer, the immediate result is code execution inside the sandbox rather than full device takeover; escaping the sandbox would require a separate vulnerability. The affected Android builds are prior to 156.0.8078.47 according to the Chrome stable-channel advisory and EUVD.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but requires the user to open it (UI:R); code runs in-sandbox so Scope:Unchanged with high C/I/A on the browser process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Android before 156.0.8078.47 contains a high-severity remote code execution flaw that can be triggered when a user opens a crafted HTML page, potentially exposing data and disrupting browser use for affected Android users. Although the compromise is initially confined to the renderer sandbox unless chained with a separate sandbox-escape vulnerability, the broad use of mobile Chrome makes timely remediation important. No public exploit was identified at time of analysis, and Google has released a fixed build.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB