EUVD-2026-105665
GHSA-jx2p-4cvx-w5c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Autofill use-after-free
-
ExecutionCorrupt renderer heap memory
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load an attacker-crafted HTML page that exercises the Autofill feature (UI:R user interaction is mandatory - there is no server-side or zero-click vector). No authentication is required (PR:N). A key limiting factor is sandbox confinement: the description states code executes 'inside the sandbox,' so without a chained sandbox-escape this grants only renderer-level code execution, not host/device takeover. Patched versions (156.0.8078.47 and later) are not affected. |
| Impact | Signals are moderately strong but partly conflicting. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 (High), reflecting network-reachable, low-complexity, unauthenticated exploitation needing only that a victim load a crafted HTML page. However, Google's own Chromium rating is only 'Medium', and the description explicitly states code execution occurs 'inside the sandbox' - i.e., confined to the renderer process with no scope change (S:U) and no demonstrated sandbox escape. This tension means the 8.8 likely overstates real-world severity: a renderer-confined UAF is a meaningful building block but typically requires a second sandbox-escape bug to achieve full device compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. No SSVC decision data was supplied. Net: a genuine memory-corruption flaw worth patching promptly given Chrome's reach, but currently a browser-hygiene priority rather than an emergency - treat as 'High-CVSS, Medium-real-risk' pending any KEV/POC change. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious web page and lures an Android Chrome user (via link, ad, or compromised site) to open it. The page triggers the use-after-free in the Autofill component, corrupting renderer memory to execute attacker-controlled code within Chrome's sandbox. No public exploit code is referenced, and full device compromise would additionally require a separate sandbox-escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Arbitrary code execution inside the Chrome for Android sandbox (versions before 156.0.8078.47) can be triggered by a crafted HTML page that exploits a use-after-free in Autofill. The attacker must persuade the victim to load the page (UI:R), but no authentication is required (PR:N); the resulting code runs within the renderer sandbox unless a separate sandbox-escape vulnerability is chained. No public exploit code has been identified at time of analysis, and Google has released fixed build 156.0.8078.47.
RemediationAI
Upgrade Chrome for Android to version 156.0.8078.47 or later through Google Play or a managed Play Store, then verify the installed version in Chrome settings; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium tracking issue is https://issues.chromium.org/issues/562236428. If immediate patching is not possible, reduce exposure by disabling Autofill for addresses and payment methods in Chrome settings or via enterprise policies such as AutofillAddressEnabled=0 and AutofillCreditCardEnabled=0, accepting the loss of form-filling functionality and recognizing that such configuration may not cover every Autofill code path. Restrict browsing of untrusted links on unpatched Android devices and do not treat the renderer sandbox as a substitute for patching; host compromise would require a separate sandbox-escape chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's Autofill component, which handles storage and insertion of address and payment data into web forms. Autofill processes attacker-influenced DOM and form lifecycle events; a crafted page can cause an object to be freed while a stale reference remains, leading to memory corruption that may be shaped into code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reachability, low attack complexity, no required privileges, mandatory user interaction, and high confidentiality, integrity, and availability impact, even though Chromium rates the issue Medium. The description limits the impact to code execution inside the sandbox, meaning renderer-level compromise rather than host takeover absent a chained sandbox escape. Affected scope is Chrome for Android before 156.0.8078.47; the Chromium issue is 562236428 and the Chrome Releases advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory victim interaction (UI:R); renderer-confined RCE gives high C/I/A with no sandbox escape, so S:U.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google has released a fixed build of Chrome for Android (156.0.8078.47) addressing a high-severity flaw in the Autofill component that allows code execution inside the browser's renderer sandbox when a user visits a crafted web page. Because Chrome for Android is widely deployed across the mobile fleet and users must simply browse to a malicious page, the exposure footprint is broad and not limited to privileged or technical staff. Leadership should care because successful exploitation can compromise sensitive data handled in the browser session and serves as a foothold for further attack chains, making timely mobile browser update enforcement a governance and risk-reduction priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB