EUVD-2026-105689
GHSA-hhq9-jvjq-hfg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious JS exercises Performance APIs
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionReclaim freed object, execute code
-
ImpactAttacker code runs in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in Google Chrome for Android on a version prior to 156.0.8078.47; the malicious page must exercise the Performance APIs to trigger the use-after-free, so user interaction (navigation) is mandatory (UI:R). No authentication is needed (PR:N). The principal limiting factor is that successful code execution is contained within the Chrome renderer sandbox - meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability, which this CVE does not provide. Affected platform is specifically Chrome on Android; desktop builds are not named here. |
| Impact | Signals conflict and must be weighed carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) scores this High: network-reachable, low complexity, no privileges, requiring only that a victim open a crafted HTML page. However, Google's own Chromium security severity rating is 'Low', and the description explicitly states code execution occurs 'inside the sandbox' - meaning this is a renderer-process compromise, not full device takeover. These two facts materially lower real-world risk: an attacker gains code execution confined to the Chrome sandbox and would need to chain a separate sandbox-escape/privilege-escalation bug to affect the host. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: patch in normal cadence rather than emergency priority. The 8.8 CVSS overstates practical impact because it does not credit the sandbox containment that Google's 'Low' rating reflects; treat this as a sandbox-contained memory-corruption bug pending any sandbox-escape chaining or exploitation evidence. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that abuses the Performance APIs to trigger a use-after-free in Chrome for Android; when a victim navigates to the page, the freed object is reclaimed and manipulated to execute attacker-controlled code within the renderer sandbox. No authentication is required but the victim must actively visit the page (UI:R). No public proof-of-concept was provided, and the resulting code execution is confined to the sandbox absent a separate escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome for Android's PerformanceAPIs (versions prior to 156.0.8078.47) can let a remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N); no public exploit identified at time of analysis, and this CVE does not provide a sandbox escape. Risk signals conflict and must be weighed carefully: CVSS 8.8 with high confidentiality/integrity impact contrasts with Chromium's Low severity rating and the renderer-sandbox containment, while a vendor patch is available.
RemediationAI
Upgrade Google Chrome for Android to 156.0.8078.47 or later; this is the vendor-released patch version and should be delivered through Google Play. Confirm the installed version after updating, and use managed Play Store/EMM policies to enforce timely browser updates on fleet devices. If immediate updating is not possible, reduce exposure by restricting users to trusted web content and, where operationally feasible, disabling JavaScript for untrusted sites-recognizing that this breaks many sites and is only a partial mitigation because the underlying renderer flaw remains. Because code execution is confined to the Chrome sandbox, prioritize patching but also maintain layered defenses against sandbox-escape chains. Vendor advisory: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Chrome's PerformanceAPIs, JavaScript-accessible interfaces used for performance measurement and timing in the renderer. A crafted HTML page can drive the API into dereferencing freed memory, corrupting renderer state and potentially achieving arbitrary code execution within the Chrome sandbox on Android. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the attacker is remote and unauthenticated but must convince the victim to open the page; scope is unchanged, and the independent assessment stresses that host compromise would require a separate sandbox-escape chain not supplied by this CVE. Chromium rates the issue Low, likely reflecting the sandbox boundary, even though the generic CVSS score is 8.8. No CPE strings were provided; EUVD identifies Chrome for Android before 156.0.8078.47.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remotely reachable via a crafted page (AV:N, AC:L, PR:N), requires victim navigation (UI:R); renderer-contained RCE keeps scope unchanged (S:U) with high C/I/A within that process.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android (versions prior to 156.0.8078.47) carries a high-scored memory-safety flaw in its PerformanceAPIs component that a remote, unauthenticated attacker could trigger by getting a user to open a crafted web page, potentially running code inside the browser's renderer sandbox. Because the flaw does not by itself escape the sandbox, the practical blast radius is largely confined to browser-process data on the affected device rather than the wider corporate network - but for a mobile workforce that browses on unmanaged or BYOD handsets, that still means exposure of session tokens, cached credentials, and corporate web content. Leadership should care because remediation is simple and already available, and the residual risk sits with user behaviour and device-update latency rather than with novel attacker capability.
Apply vendor patch. Where devices cannot be updated immediately, restrict browsing of untrusted links through managed browser policy, and treat high-risk or unmanaged handsets as untrusted for corporate web access until they report version 156.0.8078.47 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB