EUVD-2026-105554
GHSA-w3cc-434h-49x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage loads in Chrome Android Custom Tab
-
ExecutionTrigger memory corruption in CustomTabs
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open attacker-controlled HTML content within Google Chrome's CustomTabs component on Android (UI:R), making user interaction the primary limiting factor; there is no authentication requirement (PR:N) and no special target configuration is named. Exploitation is further bounded in two ways: it affects only Chrome for Android versions prior to 156.0.8078.47 (patched builds are not vulnerable), and the description confines the result to arbitrary code execution inside the renderer sandbox, so full device compromise would require an additional, unlisted sandbox escape. |
| Impact | Signals are mixed and should temper the raw score. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable code-execution flaw requiring only that a victim open a crafted HTML page. However, the description explicitly scopes the outcome to 'execute arbitrary code inside the sandbox,' and Google/Chromium rated the issue only Medium severity - a notable conflict with the 8.8 High CVSS, because sandboxed code execution without a chained sandbox escape is materially less impactful than full-host RCE. There is no CISA KEV listing, no reported public proof-of-concept, and no EPSS score in the provided data, so exploitation probability cannot be quantified from these inputs. Net assessment: a credible, patch-worthy browser memory-corruption bug that defenders running Chrome on Android should remediate promptly, but absent a KEV listing, a POC, an EPSS value, or evidence of a sandbox escape, this reads as a standard high-CVSS-but-moderate-real-risk Chrome fix rather than an emergency. Conflict to verify with vendor: CVSS=8.8 High versus Chromium-assigned Medium, and C:H/I:H/A:H versus the description's explicit in-sandbox confinement. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page and lures an Android user into opening it within a Chrome Custom Tab (for example, a link rendered inside another app). Rendering the page triggers the CustomTabs memory-corruption flaw (CWE-119), letting the attacker run arbitrary code within the renderer sandbox. No public exploit identified at time of analysis, and the attacker gains only sandbox-level code execution unless a separate sandbox escape is chained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the CustomTabs component of Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact, but exploitation requires user interaction and remains contained by Chrome's sandbox unless a separate sandbox escape is chained. Google has released a fixed build, and the provided intelligence shows no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later, distributed through Google Play and documented in the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (Chromium issue: https://issues.chromium.org/issues/513789297). Verify the installed version through Chrome's About/Settings page and enforce managed updates where possible. Because exploitation requires a victim to open crafted HTML, interim risk reduction can include restricting links or in-app CustomTabs launches to trusted domains and cautioning users against untrusted pages; these controls are only compensating measures and may break legitimate in-app browsing workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-113238 is a CWE-119 memory-buffer bounds error in Chrome's CustomTabs implementation on Android, the component that lets apps open web content in a Chrome-backed tab. A crafted HTML page can trigger the memory corruption, which the advisory maps to possible arbitrary code execution inside the Chromium renderer sandbox. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that needs the victim to interact with the page; it does not imply escape from the Android/Chrome sandbox, so full device compromise would require an additional vulnerability. Chromium rates the issue Medium, while the supplied CVSS score is 8.8, reflecting high impact but sandbox-limited execution. No CPE strings were supplied, but the affected surface is Chrome for Android prior to 156.0.8078.47.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page with no auth (AV:N/PR:N) but requires the victim to open it (UI:R); high impact reflects in-sandbox arbitrary code execution, scope unchanged as no escape is confirmed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the CustomTabs component that could let a remote attacker execute code within the browser sandbox when a user opens a crafted web page. Although exploitation requires user interaction and the sandbox limits containment unless a separate escape is chained, a successful attack could compromise sensitive organizational data on mobile devices. A vendor-released patch: 156.0.8078.47 is available, and no public exploit identified at time of analysis, so leadership should prioritize updating the mobile fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB