EUVD-2026-105704
GHSA-9fhw-m566-fw7h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious link
-
DeliveryLoad crafted HTML page in Chrome Android
-
ExploitTrigger memory corruption in Toolbar component
-
ExecutionExecute arbitrary code inside renderer sandbox
-
ImpactAccess in-process browser/session data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an Android device running Google Chrome prior to 156.0.8078.47 and a victim who actively loads an attacker-crafted HTML page in that browser (per UI:R) - there is no persistent server-side service to attack unprompted. No special non-default configuration is named in the description; the key limiting factor is the required user interaction (navigating to the malicious page) and the fact that resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape bug would be needed for host-level compromise. No authentication is required (PR:N). |
| Impact | Signals conflict on this one. The input CVSS is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R - network-reachable, low-complexity, unauthenticated, requiring only that a victim load a page - yet Google's own Chromium security team rated this 'Low' severity, and the description qualifies the outcome as code execution 'inside the sandbox' rather than a full sandbox escape. Sandbox-contained renderer code execution is materially less dangerous than host compromise, which largely explains the vendor's Low rating and the gap versus the 8.8 score. No EPSS score, no KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a patch-on-normal-cadence browser memory-corruption bug, not a drop-everything emergency - treat the 8.8 as an upper bound that the vendor's Low rating and sandbox containment pull down in real-world priority. Note also that the primary reference points to a 'stable-channel-update-for-desktop' blog post while the CVE text specifies Android; verify the correct advisory with Google. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an Android Chrome user into visiting it (e.g., via a link in a message or a malicious ad). Rendering the page triggers memory corruption in the Toolbar component, potentially allowing arbitrary code execution confined to the renderer sandbox. No public proof-of-concept was provided, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Toolbar component of Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8, yet Google assigns Chromium severity Low and the independent assessment stresses that code execution is confined to the renderer sandbox, so host-level compromise would require a separate sandbox-escape flaw; exploitation hinges on user interaction (UI:R) and no persistent server-side service is exposed. No public exploit code has been identified at the time of analysis, and the signals around this CVE conflict, so the practical risk should be weighed against the sandbox confinement and the lack of observed exploitation.
RemediationAI
Upgrade Google Chrome for Android to version 156.0.8078.47 or later through the Google Play Store, then confirm the installed version under Chrome Settings > About Chrome; organizations should enforce the minimum version through Android Enterprise or an EMM/MDM policy and block sideloaded or outdated Chrome APKs to prevent regression. Google's stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and the Chromium issue at https://issues.chromium.org/issues/514078082 are the authoritative references. Because exploitation requires the victim to load a crafted HTML page and the resulting code execution is contained within the renderer sandbox, no configuration toggle directly mitigates the bug; where patching is delayed, the practical compensating controls are to restrict browsing on affected devices to a managed, fully updated browser, disable or suspend Chrome for Android via EMM policy, and block untrusted or uncategorized web content through network filtering or a protective DNS/web proxy. Each of these carries trade-offs: disabling Chrome breaks user workflows and may push users to unmanaged browsers, while content filtering adds latency and false positives and does not eliminate the risk for allowed sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect (CWE-119, improper restriction of operations within the bounds of a memory buffer) in the Toolbar UI component of Chrome for Android. A crafted HTML page causes out-of-bounds memory access in the renderer process, which under the right heap conditions can be leveraged into arbitrary code execution. Because Chromium renders untrusted web content in a sandboxed renderer, any code execution achieved this way is limited to that sandbox; escaping to the Android host would require chaining a second, independent sandbox-escape vulnerability. The attack path is network-delivered HTML requiring the victim to navigate to the attacker's page (UI:R) and no privileges (PR:N), which is consistent with the assessed CVSS vector; Google's Low Chromium severity reflects the sandbox boundary and the difficulty of turning the corruption into a reliable exploit, but the 8.8 base score reflects the high confidentiality, integrity, and availability impact within the compromised renderer.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted HTML needs no privileges (PR:N) but requires the victim to load the page (UI:R); code runs within the renderer so scope is unchanged (S:U) with high in-sandbox C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android releases before 156.0.8078.47 contain a memory-corruption flaw in the Toolbar component that could allow a crafted webpage to run code inside the browser sandbox when a user opens it. The issue requires user interaction and is confined to the renderer sandbox, so host-level compromise would require a separate sandbox-escape flaw; no public exploit code has been identified at time of analysis. Leadership should treat this as a routine mobile patch-management priority rather than an emergency, while ensuring unpatched Android devices are updated promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB