EUVD-2026-105511
GHSA-rmhm-rchq-w6qj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger range error in SiteIsolation
-
ExecutionCorrupt memory in renderer
-
ImpactExecute arbitrary code inside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory index range validation
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome on Android at a version prior to 156.0.8078.47 to open an attacker-controlled crafted HTML page (UI:R - user interaction via navigation is mandatory). No authentication or prior privileges are needed (PR:N). The key limiting factor is that resulting code execution is confined to the renderer sandbox (S:U, 'inside the sandbox'), so a successful attack yields only renderer-process compromise unless chained with an additional sandbox-escape vulnerability; patched Chrome versions are not affected, and non-Android Chrome builds are outside the stated scope. |
| Impact | Signals are mixed and point to a moderate, not top-tier, real-world priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) describes network-reachable, low-complexity, unauthenticated exploitation requiring only that a victim open a crafted HTML page - a classic drive-by browser profile. However, two factors temper this: (1) the description explicitly states code executes 'inside the sandbox,' meaning this is a constrained renderer-level compromise that still requires a separate sandbox-escape chain for full device takeover, and (2) Chromium's own vendor severity rating is 'Medium,' which is notably lower than the 8.8 CVSS High. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note the discrepancy explicitly: CVSS rates C/I/A all High while the description's 'inside the sandbox' wording and the vendor 'Medium' rating suggest the practical impact of this single bug is lower than 8.8 implies - the High CVSS reflects worst-case renderer-process data exposure, not confirmed full RCE on the device. Treat as a standard Chrome patch-cycle priority rather than an emergency. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an Android Chrome user (via link, ad, or compromised site) to visit it. The page triggers the SiteIsolation range error, achieving arbitrary code execution within the renderer sandbox; a realistic full-device attack would chain this with a separate sandbox escape. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Arbitrary code execution inside the renderer sandbox is possible in Google Chrome for Android builds prior to 156.0.8078.47, where a range error (CWE-118) in the SiteIsolation component is reachable through a crafted HTML page. Attackers who convince a victim to navigate to such a page can corrupt memory in the renderer process; because the flaw is confined to the sandbox (CVSS S:U), the practical outcome is renderer-process compromise rather than direct operating-system takeover unless the attacker chains a separate sandbox-escape bug. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the vendor rates it Medium severity while the CVSS 3.1 base score of 8.8 reflects high confidentiality and integrity impact with mandatory user interaction (AV:N/AC:L/PR:N/UI:R).
RemediationAI
Upgrade Google Chrome for Android to 156.0.8078.47 or later through the Google Play Store, and verify the installed build via chrome://version or the Play Store listing; the vendor advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the underlying fix is tracked at https://issues.chromium.org/issues/500522368. This is a vendor-released patch, so no workaround is required once the update is applied; enterprises managing Android devices should push the update through their EMM/MDM pipeline and, where feasible, enforce a minimum Chrome version policy to close the exposure window. Where immediate patching is not possible, the realistic compensating controls are behavioral rather than technical, since Android Chrome exposes no user-facing switch to disable site isolation for this code path: restrict affected devices to a managed allowlist of trusted web destinations or route untrusted browsing through a remote-rendering or isolated browser service, accepting the added latency and reduced compatibility that comes with it, and treat the residual risk as renderer-only compromise provided no sandbox-escape chain is publicly known.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiteIsolation is Chrome's process-model security architecture: it assigns cross-site documents to separate renderer processes so that a compromised renderer from one origin cannot directly read another origin's DOM or memory, which is the cornerstone defense against speculative-execution and same-process memory-corruption attacks. The root cause class here is CWE-118 (Incorrect Access of Indexable Resource / 'Range Error'), meaning an index, offset, or length value is not properly validated against the bounds of the underlying buffer, producing an out-of-bounds read or write inside the renderer. Because the vulnerability sits in the site-isolation machinery itself, a crafted HTML page is sufficient to reach the faulty code path during document loading and process assignment. On Android, Chrome operates under tighter memory budgets and a slightly reduced site-isolation configuration compared with desktop, and the vendor explicitly scopes this issue to Chrome on Android; desktop and other platform builds are outside the stated affected range. Exploitation yields code execution with the privileges of the renderer sandbox (CVSS S:U), so the sandbox boundary must be crossed by a separate vulnerability to escalate to the host.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted web page gives AV:N/AC:L/PR:N with UI:R for navigation; S:U because execution stays inside the renderer sandbox, with High C/I/A reflecting worst-case renderer-process compromise.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android builds prior to 156.0.8078.47 are affected by a high-severity SiteIsolation memory corruption flaw that can allow a crafted webpage to execute code inside the renderer sandbox, potentially exposing browser data and disrupting user workflows. The flaw is reachable by an unauthenticated attacker through user interaction, and no public exploit identified at time of analysis means immediate risk is moderate, but unpatched mobile endpoints remain a leadership concern because they are widely used and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB