EUVD-2026-105727
GHSA-rgmj-9j63-f8xx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger memory corruption in Messages component
-
ExecutionExecute arbitrary code within renderer sandbox
-
ImpactAccess in-process browser/web data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively navigate Chrome on Android (versions prior to 156.0.8078.47) to attacker-controlled crafted HTML, so user interaction is mandatory (UI:R) and there is no authentication requirement (PR:N). The decisive limiting factor is that successful code execution is confined to the renderer sandbox per the description - the attacker does NOT obtain host/OS code execution unless this is chained with a separate sandbox-escape vulnerability. Exploitation is further limited to the affected Android Chrome build range; patched builds are not vulnerable. |
| Impact | Signals conflict sharply and must be weighed carefully. The vendor-supplied CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R) frames this as a high-severity network-reachable flaw requiring only that a victim visit a crafted HTML page, yet Google's own Chromium severity rating is explicitly 'Low,' and the description states code execution occurs 'inside the sandbox' - meaning the renderer sandbox contains the compromise and the attacker does NOT gain host-level code execution without a separate sandbox-escape chain. This containment is the single most important risk-reducing factor and explains the Low Chromium rating despite the high CVSS. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no POC was supplied, so exploitation status is 'no public exploit identified at time of analysis.' Memory-corruption bugs in Chrome are historically attractive to exploit developers and are frequently chained, but as a standalone sandboxed-renderer bug this is a patch-in-normal-cycle priority rather than an emergency - unless it is later combined with a sandbox-escape. Note also a source inconsistency: the description specifies Android, but the vendor references point to the 'Stable Channel Update for Desktop' blog - verify the exact affected platform/channel with Google. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing malicious HTML that triggers the memory-corruption flaw in the Messages component when a Chrome-on-Android user navigates to it. Successful exploitation yields arbitrary code execution confined to the browser's renderer sandbox, not the underlying OS. No public exploit code was identified at time of analysis, and real-world impact would typically require chaining with a separate sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the Messages component of Google Chrome for Android prior to 156.0.8078.47 lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the renderer sandbox. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no authentication is required but the victim must actively navigate to attacker-controlled content, which materially raises the bar for exploitation. Impact signals conflict: the CVE carries an 8.8 base score while Chromium rates the issue 'Low' severity, and because the description confines the outcome to the sandbox, host-level compromise would require chaining a separate sandbox escape; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Android to 156.0.8078.47 or later, distributed through Google Play and the Chrome stable channel per the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; because Play updates can lag or be blocked on managed devices, verify the installed build under Settings > About Chrome rather than assuming auto-update succeeded, and force the update via managed Play policy (auto-update enforcement / minimum version constraints) on Android Enterprise fleets. Where immediate patching is not possible, reduce the attack path that this bug depends on: restrict browsing to an allowlisted set of domains via Chrome Enterprise policy or a managed browser, since exploitation requires the victim to load attacker-controlled HTML - the trade-off is loss of general web access for those users; alternatively, confine high-risk browsing to a separate low-privilege profile or work-managed device so a renderer compromise does not sit alongside sensitive credentials, at the cost of operational friction. Do not rely on disabling JavaScript as a primary control, because the affected message-handling path may not be script-gated and the breakage to business applications is severe; and treat the residual risk as sandbox-bounded but chainable, meaning a renderer compromise should be treated as a precursor to host compromise during incident triage. Monitor the Chromium issue tracker for any follow-on sandbox-escape reference and re-prioritize if the bug is later reported as exploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (improper restriction of operations within the bounds of a memory buffer) covers the classic out-of-bounds read/write family that Chrome's renderer has historically been hardened against with ASLR, CFI, partition allocation and the V8/Blink sandbox. The affected surface is the 'Messages' component on the Android build of Chrome, i.e. the browser's message-handling path (IPC/Mojo-style message dispatch and deserialization between renderer processes and the browser process) rather than a scripting-engine JIT bug. That positioning matters: corruption triggered while processing a message within a compromised or hostile renderer gives the attacker a controlled primitive, but the Chromium security model keeps the blast radius inside the sandbox, so code execution lands in the renderer rather than on the host OS. Any real-world severity uplift therefore depends on pairing this bug with an independent sandbox-escape, a pattern typical of high-value Chrome exploit chains. The weakness is specific to Android Chrome builds below 156.0.8078.47; desktop and already-patched Android builds are out of scope per the vendor advisory.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim navigation (AV:N/UI:R/PR:N); code exec stays within the renderer so scope is unchanged (S:U) with high impact to in-process data.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android prior to version 156.0.8078.47 contains a memory-corruption flaw in its Messages component that could let a remote attacker execute code inside the browser's renderer sandbox if a user opens a crafted HTML page. Although the CVE is rated HIGH (8.8), Chromium's own 'Low' rating, the required user interaction, and sandbox confinement mean host compromise would require an additional exploit chain; no public exploit identified at time of analysis and the issue is not in CISA KEV. Leadership should care because Chrome for Android is widely deployed across mobile fleets, and a vendor patch is available, making prompt update verification a manageable risk-reduction action.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB