EUVD-2026-105709
GHSA-4h67-5vhx-3p4c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in CustomTabs
-
ExecutionExecute arbitrary code within Chrome sandbox
-
ImpactAccess browser session data in sandboxed context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML content through Chrome's CustomTabs component on Android (UI:R), so it is not fully unattended - a user must open or be redirected to the malicious page. The flaw affects Chrome on Android versions prior to 156.0.8078.47; patched builds are not vulnerable. Critically, successful exploitation yields code execution only 'inside the sandbox' per the vendor, meaning no sandbox escape or host OS compromise is claimed from this issue alone, which limits realistic blast radius to the sandboxed browser context absent a chained escape. |
| Impact | Signals conflict notably on this one. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8 HIGH, implying remote unauthenticated code execution requiring only user interaction (visiting a page). However, Google's own Chromium security team rated this 'Low' severity, and the description explicitly states code execution is 'inside the sandbox' - meaning the attacker gains execution within the confined renderer/CustomTabs context rather than full device compromise, which materially reduces real-world impact versus the 8.8 score. This CVSS-vs-vendor-severity gap should be treated as the dominant signal: the 8.8 does not reflect a sandbox escape. EPSS score is not provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not a confirmed in-the-wild threat. Net: patch as part of normal Chrome auto-update cadence; this is a genuine memory-corruption bug but the sandbox confinement plus 'Low' vendor rating argue against emergency prioritization despite the HIGH CVSS number. |
| Exploit ScenarioDerived | A remote attacker crafts a malicious HTML page and lures an Android user into opening it via Chrome CustomTabs (e.g., an in-app browser link). Rendering the page triggers the memory-corruption flaw in CustomTabs, letting the attacker run arbitrary code within the Chrome sandbox. No public exploit code is identified at time of analysis, and successful attack requires the victim to interact by loading the attacker-controlled content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Chrome's CustomTabs component on Android can let an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page, requiring user interaction. Google rates the Chromium security severity Low and the vendor notes impact is confined to the sandbox, which tempers the 8.8 CVSS score; affected builds are Chrome for Android before 156.0.8078.47, and no public exploit was identified at time of analysis. The issue is fixed in 156.0.8078.47.
RemediationAI
Upgrade Google Chrome for Android to 156.0.8078.47 or later through Google Play and verify the installed version in Chrome Settings > About Chrome; this is the vendor-released patch. For managed fleets, enforce a minimum Chrome version via Google Play managed configurations or EMM and block sideloaded or outdated builds, accepting that enforcement may disrupt users who cannot update. If immediate updating is impossible, reduce exposure by disabling or restricting Custom Tabs where apps allow an in-app browser choice, routing links to a patched browser, and avoiding opening untrusted links in Chrome; these workarounds can break SSO and in-app authentication flows that rely on Custom Tabs. Keep Chrome's sandbox and site isolation enabled and treat this bug as sandbox-confined unless chained with a separate escape. Vendor advisory: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; Chromium issue: https://issues.chromium.org/issues/517320634.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CustomTabs is Android's mechanism for apps to open web content in a customized Chrome tab while retaining the app's UI context; because it accepts attacker-influenced URLs and HTML, memory-safety bugs in the component are reachable from web content. CWE-119 (improper restriction of operations within the bounds of a memory buffer) describes the root cause: malformed HTML drives out-of-bounds memory access in Chrome's Android code, corrupting memory and potentially redirecting execution. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network reachability, no privileges, and required user interaction; crucially, the vendor's 'inside the sandbox' scope means no sandbox escape or host compromise is claimed from this bug alone, so real-world impact depends on a chained exploit. No CPE strings were supplied; EUVD lists Chrome versions below 156.0.8078.47 on Android as affected.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges but requires the user to load it (UI:R); code execution in the sandbox yields high C/I/A with scope unchanged as no escape is claimed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android builds earlier than 156.0.8078.47 carry a memory-corruption flaw in the CustomTabs component that could let a remote attacker run code inside the browser sandbox when a user opens a crafted HTML page. The 8.8 CVSS score is tempered by Google's Low Chromium severity rating, sandbox confinement, and the fact that no public exploit identified at time of analysis; practical exposure is concentrated in mobile workforces running unpatched Android browsers. Leadership should care because Chrome for Android is widely deployed on employee devices, and a successful attack could undermine trust in mobile browsing even if sandbox boundaries limit lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB