EUVD-2026-105540
GHSA-g632-48vg-cwph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers use-after-free in Site Isolation
-
ExecutionCorrupt freed renderer memory
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome on Android (versions prior to 156.0.8078.47) and to load attacker-controlled HTML content (UI:R / user interaction) - e.g., visiting a malicious site or rendering a malicious iframe/ad. No authentication or special privileges are needed (PR:N), and default configurations are affected since Site Isolation is a standard Chrome component. The principal limiting factor is that code execution is confined to the sandboxed renderer process; achieving host/device compromise would require chaining a separate sandbox-escape vulnerability. Platform is limited to Android builds of Chrome. |
| Impact | Signals are moderately conflicting and warrant nuanced prioritization. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) implies a high-severity, network-reachable, unauthenticated flaw requiring only that a victim load a crafted page. However, Google's own Chromium rating is 'Medium', and the description explicitly states code execution occurs 'inside the sandbox' - meaning the attacker gains control of the sandboxed renderer process, not the host, so real-world impact is materially lower than a scope-changed full-system RCE unless chained with a separate sandbox-escape bug. No EPSS score, KEV listing, or POC was provided; by the precision rules this is 'no public exploit identified at time of analysis.' Net: this is a legitimate high-CVSS browser memory-corruption bug that should be patched promptly given Chrome's enormous footprint, but in the absence of exploitation evidence and given sandbox containment, it is a routine-urgent patch rather than an emergency. The AV:N/UI:R scope vs. the sandbox-confined outcome is the key tension - the renderer-only impact caveat should be verified against Google's advisory, and the S:U (unchanged scope) in the vector is consistent with the sandbox not being escaped. |
| Exploit ScenarioDerived | A remote attacker hosts a malicious web page (or injects malicious content into an ad/iframe) and lures an Android Chrome user to visit it. The crafted HTML triggers a use-after-free in the Site Isolation component, allowing the attacker to execute arbitrary code within the browser's sandboxed renderer process. No public exploit code was identified in the provided data, and full device compromise would require an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Chrome's SiteIsolation component on Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page (UI:R required, PR:N). Only Android builds prior to 156.0.8078.47 are affected; the resulting code execution is confined to the sandboxed renderer, so full device compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor-rated severity combined with a high CVSS (8.8) and a memory-corruption/RCE tag profile makes prompt patching advisable; the vendor has released a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later via Google Play (or the applicable managed-app distribution channel) using the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Enterprise and MDM administrators should verify the installed Chrome version on managed Android fleets and enforce a minimum version of 156.0.8078.47, since the flaw is reachable simply by rendering attacker-controlled HTML and needs no user credentials. Because the defect lives in SiteIsolation, disabling or weakening site isolation is not a recommended workaround - it removes a key defense-in-depth boundary and would broaden exposure rather than reduce it. Where immediate update is impossible, restrict browsing to a curated allowlist or route Android Chrome traffic through a proxy that blocks untrusted/uncategorized content, accepting the usability and coverage trade-offs of those controls; note that Chrome's release cadence and Play Store auto-update generally make patching fast, so residual risk from deferral should be brief. Monitor https://issues.chromium.org/issues/511806651 for any later disclosure of additional details or exploit activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-416 (use-after-free) is a memory-safety flaw in which a heap object is freed but a dangling pointer to it is later dereferenced, letting an attacker who controls heap layout (here, via crafted HTML/JavaScript rendered in Chrome) reclaim the freed allocation with attacker-influenced data and hijack control flow. The affected component is SiteIsolation - Chrome's process-per-site architecture that places cross-site content in separate renderer processes as a defense-in-depth boundary against speculative side channels and renderer compromise. The flaw specifically affects the Android implementation of that component; because Site Isolation is a default, standard Chrome mechanism, ordinary browsing configurations are exposed. Exploitation occurs in the renderer process, meaning the immediate primitive is arbitrary code execution inside the Chrome sandbox rather than at OS privilege level. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-delivered attack requiring victim interaction (loading the malicious page) with no privileges and high confidentiality/integrity impact within the vulnerable component's security scope. Chromium security severity is rated Medium by Google, which typically reflects the need for a sandbox escape chain or other preconditions before full compromise.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim load (AV:N/UI:R); no privileges (PR:N); scope unchanged as code stays in sandbox (S:U), with high renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android versions prior to 156.0.8078.47 contain a high-severity memory-corruption vulnerability that can allow a remote attacker to execute code within the browser’s renderer sandbox if a user loads a crafted web page. No public exploit identified at time of analysis, but the broad mobile user base and potential browser-session data exposure warrant leadership attention and prompt remediation. The vendor has released a fixed build, making update enforcement the primary risk-reduction step.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB