EUVD-2026-105639
GHSA-qfxf-76x9-v6q6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious Omnibox input
-
ExploitTrigger improper input validation
-
ExecutionExecute arbitrary code in sandbox
-
ImpactRenderer-level compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a victim using Google Chrome on Android at a version prior to 156.0.8078.47 to load or interact with an attacker-crafted HTML page that supplies malformed input processed by the Omnibox component (UI:R). No authentication or prior privileges are needed (PR:N). The key LIMITING factor is that resulting code execution is confined to the renderer sandbox - the attacker does not obtain host-level execution without chaining an additional sandbox-escape vulnerability, and the user must actively navigate to the malicious content. Upgrading to 156.0.8078.47 or later remediates the flaw. |
| Impact | Signals are moderately consistent but point to a lower real-world priority than the raw 8.8 score suggests. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) models the flaw as a high-impact, network-reachable, unauthenticated bug requiring only that a user open a crafted HTML page. However, two mitigating facts pull the practical risk down: (1) Google rated the Chromium security severity only 'Medium', and (2) the description explicitly states code execution occurs 'inside the sandbox' - i.e. this is a renderer-level compromise, NOT a full host takeover, which is why scope is Unchanged (S:U) and no sandbox escape is chained. EPSS is not provided in the input, so exploitation probability cannot be quantified. KEV status is absent (not listed), and no POC is referenced, so exploitation is theoretical at this time. No SSVC decision data was supplied. Net: a genuinely patch-worthy browser RCE given Chrome's reach and UI:R being trivially satisfied, but the sandbox containment and Google's own 'Medium' rating indicate this is a high-CVSS number that overstates standalone impact - realistic weaponization would require a second sandbox-escape bug to be dangerous beyond the renderer. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page that abuses improper input validation in Chrome's Omnibox; a victim on Android simply navigates to or interacts with the page (UI:R), triggering arbitrary code execution confined to the renderer sandbox. No authentication is required (PR:N), but the attacker gains only sandboxed execution unless they chain a separate escape. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in Google Chrome's Omnibox on Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load or interact with a crafted HTML page. Exploitation requires user interaction (UI:R) and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining a separate sandbox-escape flaw. Google rates the Chromium severity as Medium and has shipped a fixed build (156.0.8078.47); no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is lower than the raw 8.8 CVSS score suggests.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later - the release is distributed through Google Play and can be verified under Settings > About Chrome, and enterprise fleets should enforce a minimum app version through managed Google Play or the Chrome Browser Cloud Management version policy. No Omnibox-specific configuration switch disables the vulnerable parsing path, so the practical interim controls are to restrict browsing on affected devices to trusted, allowlisted sites (which limits exposure to crafted pages but degrades general web usability) and to keep the device's Chrome instance updated as the primary mitigation; disabling JavaScript may reduce the attack surface of the crafted page but breaks most modern sites and is not a reliable substitute for patching. Because code execution is sandbox-confined, maintaining OS-level patch levels and Chrome's site isolation/ sandbox protections limits post-exploitation impact should a chain be developed. Advisory references: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/556227230.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Omnibox is Chrome's combined address and search bar, responsible for parsing, normalizing and dispatching user-supplied text and URL-like input to autocomplete providers, search-engine templating and the navigation stack. The flaw is classified as CWE-20 (Improper Input Validation): malformed input accepted by the Omnibox path reaches code that does not adequately bound or sanitize it, producing a condition an attacker can steer toward arbitrary code execution. Because the affected component lives on the browser/renderer boundary, the impact is mediated by Chrome's renderer sandbox and site isolation - an attacker gains code execution inside the sandboxed process, but reading cross-origin data or touching the host OS still requires a chained sandbox escape. The issue affects Chrome for Android builds earlier than 156.0.8078.47 and is tracked in Chromium issue 556227230, with the fix shipped in the stable-channel update referenced by Google. No CPE strings were supplied in the source data, so product identification relies on the vendor advisory and the EUVD affected-version list.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); full renderer-level code execution within an unchanged sandbox scope (S:U) yields C/I/A:H.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for Android versions before 156.0.8078.47 contain a high-severity input-validation flaw in the Omnibox that could let a remote attacker execute code inside the browser's renderer sandbox when a user loads or interacts with a crafted HTML page. The impact is concentrated on workforce Android devices running unpatched Chrome, where sandboxed code execution could expose browser data and sessions, though host-level compromise would require a separate sandbox escape. No public exploit identified at time of analysis, and the sandbox confinement plus user interaction requirement make this a medium business priority rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB