EUVD-2026-105743
GHSA-25xw-g27r-wvq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled page
-
ExploitPage serves crafted media content
-
ExecutionTrigger use-after-free in Media component
-
ImpactExecute arbitrary code within renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in Google Chrome for Android at a version below 156.0.8078.47 (UI:R - user must visit attacker content; no authentication needed). The critical limiting factor is that resulting code execution is confined to the renderer sandbox per the description, so standalone exploitation does not compromise the host - a separate sandbox-escape vulnerability would need to be chained for full device impact. This confinement, combined with Chrome's automatic update mechanism rapidly shrinking the vulnerable population, substantially limits realistic risk despite the network-reachable, unauthenticated vector. |
| Impact | Signals conflict meaningfully here and the conflict is the headline. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim load a page - a high nominal score. However, Google's own Chromium security team rated this 'Low', and the description explicitly scopes code execution to 'inside the sandbox.' Renderer-sandbox code execution is not full host compromise: it would require a separate sandbox-escape to become a true RCE on the device, which is why the vendor severity and the raw CVSS diverge so sharply. On exploitation likelihood: this is NOT in CISA KEV and no POC or exploit code is referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score and no SSVC decision data were provided. Net assessment: this is a standard browser memory-corruption bug that should be patched via Chrome's normal auto-update cadence, but it is not an emergency relative to its 8.8 number - the sandbox confinement and 'Low' vendor rating indicate materially lower real-world impact than the CVSS suggests. Verify sandbox-confinement caveat against the vendor advisory before deprioritizing in high-value mobile fleets. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page (or compromises/advertises into a page) that triggers a use-after-free in Chrome's Media component when a victim using Chrome for Android below 156.0.8078.47 visits it. The flaw yields arbitrary code execution confined to the renderer sandbox, so without a chained sandbox escape the attacker's foothold is limited to the browser process. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in the Media component of Google Chrome for Android lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Only Android builds below 156.0.8078.47 are affected, and Google rates the flaw Low severity even though the CVSS 3.1 vector scores 8.8, because the resulting code execution stays confined to the sandbox and would require chaining with a separate sandbox-escape to impact the host device. No public exploit code has been identified at time of analysis, and a fixed build (156.0.8078.47) has been released by the vendor.
RemediationAI
Vendor-released patch: Chrome for Android 156.0.8078.47. Update through the Google Play Store (or Managed Google Play for managed devices) and confirm the installed build via chrome://version, since Play Store rollouts are staged and an 'auto-update' device may still be sitting on a vulnerable build for hours or days; enterprises should push the version through Chrome Browser Cloud Management or an equivalent EMM policy that enforces a minimum application version. Full advisory details are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. There is no configuration toggle that removes the vulnerable Media code path, so compensating controls are operational rather than surgical: keep the renderer sandbox and Site Isolation enabled (never launch Chrome with --no-sandbox or disable site isolation to 'work around' the bug, as that converts a sandbox-confined primitive into host compromise), restrict high-risk browsing to a managed profile or container with reduced data access, and reduce the value of a successful renderer compromise by keeping the device's other apps and credentials segregated; each of these costs usability or management overhead. Because exploitation requires the victim to load attacker-controlled HTML, blocking untrusted links via mail/web gateway filtering and enforcing Safe Browsing raises the bar, but it does not fix the underlying lifetime bug - upgrading to 156.0.8078.47 remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chromium's Media component, the Blink/media stack that handles container demuxing, decoding and playback of audio and video on Android. Media objects are reference-counted and manipulated across asynchronous decode and rendering paths; a lifetime-management error lets an object be freed while a stale pointer is still reachable, so subsequent use dereferences attacker-influenced heap memory. In Chromium this class of bug typically manifests as memory corruption that an attacker can steer toward controlled writes and ultimately arbitrary code execution within the renderer process. The description explicitly scopes impact to code execution 'inside the sandbox', which is why Google assigned Chromium security severity Low while NVD-style scoring (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects the unauthenticated network vector and high confidentiality/integrity impact to the renderer rather than to the OS. Note the scope is unchanged (S:U), consistent with no host compromise in a standalone attack; the affected platform is specifically Chrome for Android, and no CPE strings were supplied in the available feeds, so the affected family is best identified from the vendor advisory and the EUVD version boundary rather than from CPE matching.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a crafted page with no privileges (AV:N/PR:N) but requiring the victim to visit it (UI:R); scope unchanged as execution stays within the renderer sandbox (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android builds below 156.0.8078.47 carry a use-after-free flaw in the Media component that allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. Because that code execution remains confined to the sandbox and would require chaining with a separate sandbox-escape flaw to affect the underlying device, Google rates the issue Low despite an 8.8 CVSS score. Leadership should care because Chrome for Android is broadly deployed across the mobile workforce, and although no public exploit has been identified at time of analysis, a fixed build is already available and remediation is straightforward.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB