EUVD-2026-105531
GHSA-pghq-xcwc-c4rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in History component
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactOperate within sandbox pending escape chain
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in Google Chrome for Android (versions prior to 156.0.8078.47) that triggers the memory-corruption flaw in the History component - user interaction (navigating to or being redirected to the attacker-controlled page) is the gating requirement (UI:R), but no authentication or special configuration is needed (PR:N, default configuration). The principal limiting factor is that code execution is confined to the renderer sandbox; achieving full device compromise would require a separate sandbox-escape vulnerability, and the attack is constrained to the vulnerable Chrome-on-Android versions only. |
| Impact | Multiple signals point to a genuinely high-severity but not yet urgent-for-active-defense issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated code execution requiring only that the victim load a crafted HTML page - classic drive-by browser risk. However, the description explicitly scopes the outcome to 'execute arbitrary code inside the sandbox,' meaning this is a renderer-level compromise with no stated sandbox escape, which is why Chromium rated it only 'Medium' severity despite the 8.8 CVSS. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was referenced, so exploitation status is 'no public exploit identified at time of analysis.' Note the tension: the CVSS 8.8 and the Chromium 'Medium' rating diverge because CVSS does not credit the sandbox as a mitigating boundary, so the raw 8.8 overstates real-world impact for a sandboxed-only RCE. A vendor patch is available, so the priority is prompt patch deployment rather than emergency incident response. EPSS and KEV data are both absent/negative - treat the absence of exploitation evidence as 'not observed,' not as 'safe.' |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (e.g., via a malicious ad, phishing link, or compromised site) that triggers the memory-corruption flaw in Chrome for Android's History component when the victim simply visits the page. Successful exploitation yields arbitrary code execution within the renderer sandbox on the victim's Android device. No public proof-of-concept was identified in the provided data, and a full device compromise would require chaining this with a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the History component of Google Chrome for Android (versions prior to 156.0.8078.47) lets a remote attacker who persuades a victim to load a crafted HTML page execute arbitrary code, though the impact is bounded by the renderer sandbox. The flaw is unauthenticated from the attacker's perspective and requires only that the target browse attacker-controlled content (CVSS 8.8, UI:R), meaning it can be triggered through ordinary web browsing or a redirect chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has released a stable-channel fix in 156.0.8078.47.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later via the Google Play Store, and confirm the installed version in Chrome's settings before considering devices remediated; the fix is documented in the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Enterprises managing fleets through Chrome Browser Cloud Management or Play Store managed updates should force the update and verify version compliance, since the attack only needs a user to open a crafted page. Where immediate updating is impossible, reduce exposure by restricting browsing to trusted sites, disabling JavaScript-heavy untrusted content via policy, or confining high-risk web use to a separate managed profile - trade-offs are degraded functionality for legitimate sites and added user friction. Note that mitigation at the browser layer does not eliminate the residual risk of a chained sandbox escape, so applying the 156.0.8078.47 update remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, which in this case manifests as memory corruption in Chrome's History component on Android. History handling parses and processes navigational and history-state data that is influenced by page content, so a crafted HTML page can drive malformed data into an unsafe memory operation. Because the defect lives in the renderer-side History implementation, successful exploitation yields code execution at the renderer privilege level inside Chrome's site-isolation sandbox rather than in the browser process; a full compromise of the Android device would require chaining this bug with a separate sandbox-escape vulnerability. Chromium rated the underlying issue Medium security severity even though the generic CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, a divergence that reflects Chrome's assessment of the sandbox boundary and exploitation difficulty.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N; victim must load the page (UI:R); code runs in-sandbox so S:U, with high renderer-context C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in History in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android prior to 156.0.8078.47 contains a high-severity memory-corruption flaw in the History component that could allow remote code execution within the browser's renderer sandbox if a user loads crafted HTML content. Because Chrome is widely deployed across mobile workforces and the issue can be triggered through ordinary browsing or redirects, leadership should prioritize rapid version verification and managed-device update enforcement, even though no public exploit has been identified at time of analysis. The availability of a stable-channel fix enables containment through standard patch management.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB