EUVD-2026-111465
GHSA-5cqv-wxv8-gxj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers improper input validation in Chrome UI
-
ExecutionAchieve code execution within browser sandbox
-
ImpactImpact limited to sandboxed context absent further escape
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires a user running Google Chrome on Android prior to 156.0.8078.73 to open or be directed to an attacker-crafted HTML page (UI:R / user interaction is a required precondition). No authentication is required (PR:N in the provided CVSS vector), and no special or non-default configuration is indicated by the sources. The key limiting factor is containment: the description states code execution occurs 'inside the sandbox,' so impact is bounded to the browser sandbox and full device compromise would require an additional, separate sandbox-escape vulnerability not covered by this CVE. Platform scope is limited to the Android build of Chrome. |
| Impact | Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution that requires user interaction, which matches the description's 'crafted HTML page' trigger. The crucial tempering factor the base score does not capture is in the description itself: execution is 'inside the sandbox' (Chromium severity High, not Critical), so this alone does not yield full device/OS compromise without a separate sandbox-escape chain. Exploitation-likelihood signals are low and point away from imminent mass exploitation: EPSS is 0.22% (13th percentile), there is no CISA KEV listing in the input, and no confirmed public exploit is present (the chromium issue tracker link is a bug reference, not verified working exploit code). The vuln.today decision label is 'this_week', consistent with a patched, high-severity browser RCE that warrants prompt rollout but is not flagged act_now/emergency. Net: a genuine high-severity priority for timely patching, not a high-CVSS-but-trivial issue - but current data does not indicate active or widespread exploitation. Note the description phrases impact as 'potentially execute arbitrary code,' so full RCE reliability is vendor-qualified rather than demonstrated in the supplied sources. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures a user of Chrome for Android (prior to 156.0.8078.73) to open it; the page abuses improper input validation in the browser UI to achieve arbitrary code execution confined to the renderer/browser sandbox. No public, verified exploit code is identified in the supplied data, and reliable full-device compromise would additionally require a separate sandbox escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Improper input validation in the UI layer of Google Chrome for Android before 156.0.8078.73 allows remote attackers to achieve code execution inside the browser sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) but no authentication (PR:N), and impact is contained to the sandbox rather than the underlying Android OS, so full device compromise would need a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low (0.22%, 13th percentile); Google rates the issue High severity and has released a patched build.
RemediationAI
Google has released a patched build: Chrome 156.0.8078.73 for Android, documented in the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_0562499947.html. Android users and managed fleets should update Chrome to 156.0.8078.73 or later via Google Play or their enterprise distribution channel, and confirm the installed version through chrome://version; organizations should verify the update has propagated to BYOD and managed Android devices, since mobile Chrome updates typically require user action or Play Store policy enforcement. Until the update is confirmed, the practical exposure reduction is to limit browsing of untrusted links on affected Android devices. The sources do not describe additional vendor workarounds, and exploitation has not been confirmed in the wild.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-20 (Improper Input Validation) in Chrome's UI component on the Android platform. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity bug that still requires the victim to interact with attacker-supplied content - consistent with a crafted HTML page loaded in the browser. The scope metric is Unchanged, and Google's description explicitly places the resulting arbitrary code execution inside the sandbox, meaning the compromise is bounded by Chrome's renderer/UI isolation on Android and does not by itself grant OS-level privileges. The trigger mechanism beyond 'crafted HTML reaching the UI layer' is not described in the available sources. The issue was reported through Google's Chrome CVE administration process and is tracked in the Chromium issue tracker under 574803484, with a corresponding EUVD record (EUVD-2026-111465).
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page reachable over the network (AV:N/AC:L/PR:N) but needs the victim to open it (UI:R); scope unchanged as execution stays within the sandbox, with high C/I/A inside that context.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A high-severity security flaw in Google Chrome for Android could let attackers execute code within the browser's sandbox when a user visits a malicious webpage. This puts employees who use Android devices for work at risk, potentially leading to data theft or further compromise if combined with other exploits. Leadership should prioritize patching to maintain mobile security and protect sensitive company information.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB