EUVD-2026-105721
GHSA-ggxp-xw6j-4c8r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML to Chrome Android
-
ExecutionTrigger memory corruption in ContentCapture
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an Android user running Google Chrome prior to 156.0.8078.47 to load an attacker-crafted HTML page (CVSS UI:R - user interaction is mandatory); no authentication or special privileges are needed (PR:N) and default configurations are affected. The principal limiting factor is containment: per the description, code execution is confined to the renderer sandbox, so an attacker gains code execution only within the sandboxed process and would need an additional sandbox-escape vulnerability to compromise the underlying device or user data. User interaction (visiting the page) and the Android-only, pre-156.0.8078.47 scope further narrow realistic exploitation. |
| Impact | Signals conflict sharply and must be reconciled. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields 8.8 (High), implying easy remote unauthenticated code execution. However, the Chromium team rated the security severity 'Low', and the description explicitly states code execution occurs 'inside the sandbox' - a critical mitigating factor the raw CVSS score does not capture, and which is consistent with Scope:Unchanged. Sandbox-contained renderer RCE is not full device compromise; it typically requires chaining with a separate sandbox-escape bug to be weaponized, which is why the vendor's own rating is Low despite the high CVSS. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or imminent exploitation. Net assessment: this is a patch-on-normal-cycle browser bug, not an emergency - real-world risk is materially lower than the 8.8 suggests. The vendor Low rating and absence of KEV/POC should take precedence over the headline CVSS when prioritizing. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML that triggers a memory-corruption flaw in Chrome's ContentCapture component when an Android user visits it. Successful exploitation runs attacker-controlled code, but execution is confined to the renderer sandbox, so a further sandbox-escape would be needed for full device takeover. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in ContentCapture in Google Chrome for Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, although the CVSS 8.8 score conflicts with Google's Low Chromium severity and the stated sandbox containment. No public exploit code or active exploitation is identified at time of analysis, and Google has released a fixed build, 156.0.8078.47. The high CVSS versus Low vendor severity and sandbox-limited impact are conflicting signals that should be reconciled during triage.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later through Google Play, then restart the browser and verify the installed version; see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and Chromium issue 535725111 at https://issues.chromium.org/issues/535725111. If immediate update is not possible, reduce exposure by restricting Chrome for Android to trusted sites through managed browser policies or MDM where available, blocking untrusted links and enforcing URL filtering, or temporarily disabling Chrome on high-risk Android devices; these are partial compensating controls with usability and management trade-offs and do not remediate the underlying CWE-119 memory corruption. Because exploitation requires the user to load a crafted HTML page, phishing resistance and link-filtering controls provide additional but incomplete risk reduction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ContentCapture is a Chrome for Android component, and this issue is classified as CWE-119, improper restriction of operations within the bounds of a memory buffer, which is the memory-corruption class underlying the reported arbitrary code execution. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network-delivered content, no authentication or privileges required, mandatory user interaction, and high confidentiality, integrity, and availability impact within the vulnerable component's security scope. Per the description, code execution is confined to the renderer sandbox, so achieving device-level compromise would require an additional sandbox-escape vulnerability; this containment, together with the Android-only pre-156.0.8078.47 scope and required page load, narrows realistic exploitation. Google assigned Chromium security severity Low, while the supplied CVSS score is 8.8, so the two severity signals must be treated as distinct assessments rather than interchangeable.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but mandatory user interaction (UI:R); arbitrary code in the renderer gives full renderer-process C/I/A, and sandbox containment keeps Scope Unchanged.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android versions before 156.0.8078.47 contain a memory-corruption flaw in ContentCapture that could let a remote attacker run code inside the renderer sandbox when a user loads a crafted page; leadership should care because Chrome is widely deployed and a compromised renderer can undermine user trust and data confidentiality even if sandbox containment limits blast radius. No public exploit identified at time of analysis, but the CVSS 8.8 rating conflicts with Google's Low Chromium severity and the stated sandbox containment, so triage should reconcile these signals before setting risk tolerance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB