EUVD-2026-105520
GHSA-f2mr-4hg2-8fr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger buffer overflow in Extensions component
-
ExecutionExecute arbitrary code within browser sandbox
-
ImpactAccess in-sandbox browser process data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must open an attacker-crafted HTML page in Google Chrome for Android on a version prior to 156.0.8078.47; this user interaction (UI:R) is the primary gating factor and means purely passive, zero-click exploitation is not indicated. No authentication is required (PR:N) and no special non-default configuration is called out - any default Android Chrome installation that renders the malicious page is exposed. The decisive LIMITING factor is that resulting code execution is explicitly confined 'inside the sandbox,' so by itself it does not compromise the Android OS or other apps; escaping to the host would require chaining a separate sandbox-escape vulnerability. |
| Impact | This is a medium-to-high priority defensive item but not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) reflects remote, unauthenticated, low-complexity reach with only user interaction required (visiting a page), and full C:H/I:H/A:H impact. However, two signals temper the raw score and CONFLICT: (1) Google's own Chromium security team rated this 'Medium' severity, materially lower than the NVD-style 8.8 High, and (2) the description explicitly states code execution occurs 'inside the sandbox' - meaning this is NOT a full device compromise on its own and would require a separate sandbox-escape chain to reach the underlying Android OS. There is no CISA KEV listing and no EPSS score or public POC provided in the input, so there is no evidence of active exploitation - treat the C:H/I:H/A:H impacts as scoped to the sandboxed browser process, not the host. Verdict: patch promptly as part of normal Chrome update cadence given the near-ubiquitous footprint and trivial attack vector, but absent KEV/POC/EPSS data this does not rise to drop-everything emergency status. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an Android Chrome user to open it (via phishing link, malvertising, or a compromised site). When the page is rendered, it triggers a memory-corruption (buffer overflow, CWE-119) condition in the Extensions component, allowing the attacker to potentially execute arbitrary code confined within the browser sandbox. No public exploit identified at time of analysis, and full device compromise would require an additional sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Extensions component of Google Chrome for Android before 156.0.8078.47 allows remote attackers to potentially achieve arbitrary code execution inside the browser sandbox by getting the victim to render a crafted HTML page. Exploitation requires the user to open a malicious page (UI:R) but no authentication or non-default configuration, so any default Android Chrome install below the fixed build is exposed; the payoff is confined to the renderer sandbox and would need a second, separate sandbox-escape bug to reach the Android OS or other apps. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium issue only Medium severity, making this a medium-to-high priority patching item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later via the Google Play Store, and verify the installed build under Settings > About Chrome; because Android Chrome updates are staged, confirm the version string rather than assuming an automatic update landed. No mitigation short of patching fully removes the exposure, since the attack surface is ordinary web content rendered in a default install. Interim compensating controls, with their trade-offs: restrict browsing to trusted sites and enforce a managed allowlist via Android enterprise policies (reduces exposure but breaks general web use); disable or limit extensions through enterprise policy where the Android build permits it (may not be available on all builds and removes legitimate functionality); keep Chrome in a separate Android work profile with no access to corporate accounts or sensitive data (contains blast radius, but the sandboxed code execution still occurs and any chained sandbox escape would land inside that profile); and monitor for follow-on exploitation attempts that pair this bug with a sandbox-escape, since this issue alone is confined to the renderer sandbox. Patch details and the credited reporter (chrome-cve-admin@google.com) are documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds memory access (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the Extensions subsystem of Chrome for Android, a component that parses and brokers extension-related content inside the renderer. A crafted HTML page drives the parser/logic into an inconsistent buffer state, corrupting memory in a way that can be shaped into controlled execution within the sandboxed renderer process. Because Chrome's multi-process architecture places the renderer in a restricted sandbox, code execution at this layer yields the attacker the privileges of the sandboxed process only; crossing into the Android OS, other apps, or persisted data requires chaining a distinct sandbox-escape vulnerability. The affected CPE scope is Chrome for Android builds earlier than 156.0.8078.47 (EUVD records the fixed build as 156.0.8078.47), and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network-delivered content with a user-interaction gate and full confidentiality/integrity impact scoped to the vulnerable component rather than the host OS.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); scope unchanged and impacts high within the compromised sandboxed renderer process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android versions prior to 156.0.8078.47 contain a memory-corruption flaw in the Extensions component that could allow a crafted web page to execute code within the browser sandbox, affecting any default Android Chrome install below the fixed build and potentially exposing mobile users across the organization. Because exploitation requires a user to open a malicious page, remains contained to the renderer sandbox unless chained with a separate sandbox escape, and had no public exploit identified at time of analysis, this is a medium-to-high patching priority rather than an emergency, though broad mobile exposure still warrants prompt remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB