EUVD-2026-105421
GHSA-gg76-fcfh-78c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML to Chrome
-
ExecutionTrigger use-after-free in Passwords
-
ImpactExecute arbitrary code in sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome on Android at a version prior to 156.0.8078.47 and to load attacker-controlled HTML content (UI:R) - e.g. visiting a malicious site or an embedded/malvertised frame; no authentication or pre-existing privileges are needed (PR:N). The key limiting factors are: mandatory user interaction (the victim must open the crafted page), platform restriction to the Android build of Chrome, and that successful code execution is confined to the renderer sandbox, so full device compromise additionally demands a separate sandbox escape not covered by this CVE. |
| Impact | Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim load a crafted HTML page, with high confidentiality, integrity and availability impact - hence the 8.8 base score and Chromium's own 'High' rating. However, two mitigating facts temper real-world severity: the description explicitly states code execution is 'inside the sandbox,' meaning this is a renderer/process-level compromise that still needs a separate sandbox-escape chain to reach the host OS, and it is not reflected in the CVSS impact metrics. No EPSS score, no SSVC decision data, and no POC were provided, and the CVE is NOT on the CISA KEV list, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV/POC is an absence of signal, not a low-risk confirmation: Chrome memory-corruption bugs are historically attractive and frequently weaponized post-disclosure, so patching should be prompt despite the lack of current exploitation evidence. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page and lures an Android Chrome user into visiting it; the crafted HTML triggers a use-after-free in the Passwords component, letting the attacker execute arbitrary code within the renderer sandbox. No public exploit code was identified at time of analysis, and reaching the underlying device would additionally require chaining a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in the Passwords component of Google Chrome on Android before 156.0.8078.47 lets a remote attacker execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page. The flaw is unauthenticated on the attacker's side but requires user interaction (the victim must open the malicious page) and is restricted to the Android build of Chrome; successful exploitation is confined to the renderer sandbox, so full device compromise requires an additional sandbox-escape primitive not covered by this CVE. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Upgrade Google Chrome for Android to version 156.0.8078.47 or later - vendor-released patch: 156.0.8078.47 - distributed through Google Play and the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Where Play Store updates are delayed or unavailable (e.g., sideloaded APKs, restricted enterprise fleets), push the fixed build via managed Play or MDM policy and verify the version string. Compensating controls, in order of practicality: enforce Chrome updates through enterprise policy and block sideloaded or outdated browser builds on managed devices (trade-off: reduced user flexibility and added helpdesk load); restrict browsing of untrusted content through a proxy or DNS filtering layer (trade-off: incomplete coverage of embedded/malvertised frames and possible false positives); and, for high-risk users, disable or lock down password-manager features and autofill via enterprise policy while patching is pending (trade-off: loss of credential convenience and possible user workarounds). Note that because exploitation is sandbox-confined, reducing the likelihood of a second-stage sandbox escape - prompt OS security updates on Android, minimal installed apps, and no rooted/jailbroken devices - limits the blast radius if the renderer is compromised. No public exploit code was identified at time of analysis, but patch promptly given the High severity and the browser's broad exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416, a use-after-free in Chrome's Passwords component - the credential management subsystem that parses and renders password-related UI (e.g., password save/update bubbles and credential forms) on Android. A use-after-free occurs when an object in that component is freed but a stale reference is later dereferenced, typically because of a lifetime or ownership mishandling across asynchronous callbacks or renderer/UI-process interaction. In the Chromium architecture the compromised object is reachable from renderer-process content, so a crafted HTML page can bend the heap into attacker-influenced state and redirect control flow, giving arbitrary code execution within the renderer sandbox. Because the flaw lives in a Chrome-layer component rather than the Android OS itself, mitigation depends entirely on the browser build: per EUVD, all Chrome builds below 156.0.8078.47 on Android are affected, and other platforms are not described as vulnerable by this record. Chromium classifies the issue as High severity; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects network reachability with low attack complexity, no privileges required, mandatory user interaction, and high confidentiality/integrity/availability impact within the sandbox scope.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges gives AV:N/AC:L/PR:N; victim must load the page (UI:R); code runs in the sandbox without scope change (S:U) with full renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Android, before version 156.0.8078.47, contains a memory-safety flaw in the browser's Passwords component that allows a crafted web page to execute code inside the browser's renderer process. Any employee using an unpatched Android device to browse the web is a potential target, making this a broad exposure across the mobile fleet rather than an isolated one. Because successful exploitation is contained within the renderer sandbox and would require a second, separate vulnerability to threaten the device itself, the near-term organizational risk is concentrated on browser-level data and session integrity, but the affected population and the low attacker effort justify prompt remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB