EUVD-2026-105576
GHSA-vc2v-3c8p-m748
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers memory corruption in Passwords component
-
ExecutionOverflow corrupts renderer memory
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled crafted HTML page in Google Chrome for Android at a version below 156.0.8078.47 (UI:R user interaction is mandatory). No authentication or elevated privileges are needed (PR:N), and default configurations are affected. The key limiting factors are: (1) required user interaction - the attacker must induce page navigation; (2) resulting code execution is confined to the renderer sandbox, so standalone impact on the host device is limited absent a chained sandbox-escape; and (3) only the Android build in the specified version range is affected. |
| Impact | Signals are moderately consistent and point to a credible but conditional threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must open a crafted HTML page. Notably, the description constrains impact: code execution occurs 'inside the sandbox,' and Chromium itself rated this only Medium severity, which conflicts with the High 8.8 NVD-style score. The C:H/I:H/A:H impact metrics are optimistic for a sandboxed renderer compromise that, by itself, does not escape to the host; absent a chained sandbox-escape, real-world impact is lower than the score implies. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate patch-worthy memory-corruption bug in a ubiquitous product, but the Medium Chromium rating, sandbox containment, and required user interaction place it below genuinely critical, actively-exploited Chrome zero-days. Prioritize via normal Chrome update cadence rather than emergency response. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page (e.g., via a link, ad, or compromised site) and lures an Android Chrome user to visit it. The page triggers memory corruption in the Passwords component, allowing the attacker to potentially execute arbitrary code within the renderer sandbox. No public exploit code is known, and full compromise would typically require chaining with a separate sandbox-escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Passwords component of Google Chrome for Android prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (the victim must navigate to attacker-controlled content), and the resulting code execution is confined to the sandbox, so meaningful host-level compromise would require chaining with a separate sandbox escape; only the Android build in the specified version range is affected. No public exploit code or confirmed active exploitation was identified at time of analysis, though EPSS-style urgency is tempered by the conditional, interaction-dependent nature of the flaw.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later via the Play Store, and verify the installed version in Chrome's Settings > About page since staged Android rollouts can lag. Because the flaw lives in the Password Manager, a practical interim mitigation on unpatched devices is to disable password saving/autofill (Settings > Google services > Autofill and passwords, or the Password Manager settings) so the vulnerable component is not exercised, with the trade-off of losing autofill convenience and saved-credential sync on that device; alternatively, restrict browsing to trusted sites and avoid following unsolicited links until the update installs. Organizations managing Android fleets should push the 156.0.8078.47 build through their MDM/EMM channel and enforce a minimum Chrome version policy. No workaround fully removes exposure short of updating, since the attack surface is ordinary web-page rendering; refer to the Chromium release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for the official fix listing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in Chrome's Password Manager subsystem on Android. Chrome's renderer is written in C++ and relies on strict bounds checking, partition allocation, and site isolation; a buffer overflow or out-of-bounds write in password-related parsing or handling logic can corrupt heap memory in the renderer process. Because the CPE/version data pins the issue to the Android build below 156.0.8078.47, the defect is platform-specific rather than affecting desktop Chrome builds. Successful corruption of renderer memory can, under the right heap grooming, redirect control flow and yield arbitrary code execution - but under Chrome's multi-process architecture that code runs with renderer privileges inside the OS sandbox, not with full device access. Chromium rates the issue Medium severity internally, reflecting that the sandbox contains the blast radius, whereas the CVSS 3.1 score of 8.8 arises from the high confidentiality, integrity, and availability impact assumed should the renderer be fully compromised.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth gives AV:N/AC:L/PR:N but requires UI:R; renderer compromise keeps S:U with high impact to in-process data.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android versions prior to 156.0.8078.47 contain a high-severity memory corruption flaw in the Passwords component that could let a remote attacker execute code within the renderer sandbox if a user loads a crafted HTML page. The primary exposure is to the organization’s Android user base, where a successful attack could compromise browser-held credentials and session data, though full host compromise would require an additional sandbox escape. Leadership should prioritize rapid mobile browser remediation because of widespread Android deployment and the sensitive nature of password management functionality.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB