EUVD-2026-105604
GHSA-h2hm-wcp9-57pv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to open page in Chrome
-
ExecutionTrigger use-after-free in TrustedWebActivities
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome for Android at a version prior to 156.0.8078.47 and to navigate to / render an attacker-controlled crafted HTML page (UI:R - user interaction is mandatory; there is no zero-click path in the available data). The flaw resides in the TrustedWebActivities feature, which bridges native Android apps and web content, so exploitation is specific to Chrome's Android build rather than desktop. A critical LIMITING factor: the resulting code execution is confined 'inside the sandbox' (renderer process), so this vulnerability alone does not yield host/device compromise - a chained sandbox escape would be required for that. No authentication is required (PR:N). |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated, low-complexity, network-reachable use-after-free requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, two signals pull the real-world priority DOWN and conflict with the raw 8.8: (1) Google/Chromium rated this 'Medium' severity, and (2) the description states code execution occurs 'inside the sandbox,' meaning a successful exploit lands in the constrained renderer process, NOT full device compromise - a separate sandbox-escape would be needed for that. The S:U (scope unchanged) in the vector is consistent with this containment. EPSS is not provided, this CVE is NOT on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a legitimately serious memory-corruption bug in a near-universal product that warrants prompt patching, but the sandbox containment and vendor 'Medium' rating indicate it is not a standalone full-compromise RCE and is lower priority than a sandbox-escaping or actively-exploited Chrome flaw. Note the discrepancy explicitly: NVD-style CVSS reads 8.8/High while the vendor rates it Medium - the sandbox limitation is the reconciling factor. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects malicious content into an ad/iframe) that triggers the use-after-free in Chrome for Android's TrustedWebActivities handling. A victim running a vulnerable Chrome (prior to 156.0.8078.47) on Android visits the page, and the attacker gains arbitrary code execution within the browser sandbox. No public POC or exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
A use-after-free in Chrome's TrustedWebActivities component on Android allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in Chrome for Android versions prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects an unauthenticated, network-reachable flaw that nevertheless requires user interaction - the victim must navigate to or render attacker-controlled content - so no zero-click path is present in the available data. Successful exploitation yields high-confidentiality, high-integrity code execution confined to the sandboxed renderer process; escaping the sandbox to compromise the underlying Android device would require chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the 8.8 base score.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later, distributed through the Google Play Store - confirm the installed version in Chrome's Settings > About Chrome page after updating, since Android updates can lag and staged rollouts may delay availability. The release advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the bug record at https://issues.chromium.org/issues/544328873. Until the update lands on managed devices, interim measures include restricting or disabling TrustedWebActivity and Custom Tabs usage within enterprise-managed apps (trade-off: breaks in-app web flows that depend on TWA/Custom Tabs), and reducing exposure to untrusted links by enforcing Safe Browsing and URL allowlisting (trade-off: operational overhead and user friction). Because exploitation is confined to the renderer sandbox, prioritizing patch rollout before any sandbox-escape chain becomes public is the most effective control; no configuration change fully removes the attack surface while the vulnerable Chrome build remains installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416 (Use After Free): a heap object associated with Chrome's TrustedWebActivities (TWA) implementation is freed while a reference to it remains live, and subsequent dereferencing of that dangling pointer allows an attacker to influence memory contents. TrustedWebActivities is the Android-specific mechanism that lets a native Android app host web content full-screen through Chrome's Custom Tabs infrastructure, so the affected code path exists only in the Android build of Chrome - desktop Chrome is not affected by this specific bug. Because the corruption occurs in the renderer, exploitation yields arbitrary code execution within the renderer's sandbox rather than at the browser-process or OS level, which is why the assessed severity is bounded despite the high CVSS impact metrics. Crafted HTML is the delivery vector, and the memory-safety nature of the defect places it in the same class as the routine renderer memory-corruption fixes Chrome ships on its stable channel cadence.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory user navigation (UI:R) and low complexity; scope unchanged as impact stays within the renderer sandbox, where C/I/A are high.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in TrustedWebActivities in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android before version 156.0.8078.47 contains a high-severity code-execution flaw that can be triggered when a user loads crafted web content, potentially exposing browsing data and enabling unauthorized actions within the browser sandbox. Because Chrome is widely deployed across mobile staff, leadership should treat this as a priority endpoint remediation item, while noting that full device compromise would require an additional vulnerability. No public exploit has been identified at time of analysis, but the broad mobile Chrome footprint and high CVSS score warrant rapid patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB