EUVD-2026-105574
GHSA-r4jh-3332-3p4v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious markup to Prompts component
-
ExploitTrigger memory corruption (CWE-119)
-
ExecutionEscape renderer sandbox
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML in Google Chrome for Android on a version prior to 156.0.8078.47; the flaw resides in the 'Prompts' component and the crafted page must trigger the memory-corruption condition. The primary limiting factor is required user interaction (UI:R) - the target must actively browse to or render the malicious page; it is not wormable or zero-click per the CVSS vector. Beyond an unpatched Chrome/Android instance, no special configuration, authentication, or privileged access is needed (PR:N), and default configurations are affected. |
| Impact | This is a genuine high-priority issue despite the vendor's own 'Medium' Chromium severity label - a notable internal conflict in the data. The authoritative CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6 (Critical) primarily because the flaw is a memory-corruption bug that executes code OUTSIDE the browser sandbox (Scope:Changed), turning a renderer-level issue into full host compromise. The attack is network-reachable, low-complexity, and needs no privileges - only that the victim loads a crafted HTML page (UI:R). The gap between the vendor 'Medium' severity and the 9.6 score likely reflects Chrome's internal severity scoring (which weights exploitability/mitigation nuances) versus NVD-style worst-case scope scoring; defenders should treat the 9.6/sandbox-escape framing as the operative risk. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is currently no evidence of active or imminent exploitation - the risk is latent (high theoretical impact) rather than demonstrated. The decisive mitigating factor is required user interaction and the fact that a patched Chrome build (156.0.8078.47) already exists. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into a compromised/ad-served page) and lures an Android Chrome user to visit it. The crafted HTML triggers memory corruption in Chrome's prompt handling, and because the corruption leads to code execution outside the sandbox, the attacker can run arbitrary code on the device. No public exploit was identified at time of analysis, and the attack requires the victim to actively load the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Prompts component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 because of the scope change and high confidentiality/integrity/availability impact, even though Google assigns a Medium Chromium severity; exploitation requires user interaction, and no public exploit code or CISA KEV entry is identified in the provided data. Google has released 156.0.8078.47 as the vendor-fixed version.
RemediationAI
Upgrade Google Chrome for Android to 156.0.8078.47 or later through the Google Play Store; the vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Patch status is vendor-released patch: 156.0.8078.47. If immediate patching is not possible, reduce exposure by restricting Chrome for Android to trusted sites and blocking untrusted HTML content at the network or secure web gateway layer, or by temporarily disabling Chrome on high-risk managed devices; these compensating controls carry usability and coverage trade-offs and do not fully eliminate the memory-corruption risk. No vendor-documented workaround beyond upgrading was provided.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google identifies the affected component as "Prompts" in Chrome for Android, and the flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a memory-corruption class that includes out-of-bounds reads/writes capable of corrupting control flow. Chrome normally renders web content inside a sandboxed renderer; the CVE description states that crafted HTML can potentially lead to code execution outside that sandbox, which is consistent with the CVSS vector's scope change (S:C). The affected platform is Google Chrome for Android prior to 156.0.8078.47, and exploitation requires the victim to browse to or render attacker-controlled HTML (UI:R) with no privileges required (PR:N). The vendor's Medium Chromium severity label conflicts with the 9.6 CVSS score, a notable discrepancy in the source data; no CPE identifiers were supplied in the intelligence.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must visit it (UI:R); sandbox escape changes scope (S:C) enabling full-host code execution, so C/I/A all High.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Articles & Coverage 1
Executive ViewAI
Google Chrome for Android versions prior to 156.0.8078.47 contain a memory corruption vulnerability that could allow a remote attacker to execute arbitrary code outside the browser sandbox when a user loads a crafted webpage, potentially leading to device compromise and data loss. This affects organizations with employees using Android devices for work, and leadership should prioritize patching because the vulnerability is rated critical, though no public exploit identified at time of analysis and user interaction is required. The vendor has released a fixed version, so timely updates can mitigate the risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB