EUVD-2026-105745
GHSA-899g-9673-p657
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
ExploitTrigger memory corruption in ContextMenu
-
ExecutionCorrupt renderer heap memory
-
ImpactExecute arbitrary code within sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in Google Chrome for Android on a version prior to 156.0.8078.47, triggering the memory-corruption flaw in the ContextMenu component (CVSS UI:R confirms required user interaction). No authentication is needed (PR:N). Key limiting factors: the attack is confined to the Android platform, depends on user interaction to load malicious content, and per the description and Chromium's 'Low' severity rating the resulting code execution occurs inside the renderer sandbox - meaning an additional sandbox-escape primitive would be required to fully compromise the device. |
| Impact | Signals are moderately consistent but contain one notable tension. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High) indicates a network-reachable, low-complexity bug needing no privileges but requiring user interaction (visiting a crafted page). In direct contrast, Chromium itself rated this issue 'Low' severity, and the description qualifies the outcome as code execution 'inside the sandbox' - i.e., no confirmed sandbox escape - which materially caps real-world impact versus the 8.8 score. No EPSS probability was provided, so exploitation likelihood cannot be quantified. KEV status is not listed and no POC is referenced, so this is not confirmed as actively exploited and no public exploit is identified. Net: this is a patch-worthy memory-corruption flaw in a ubiquitous browser, but the gap between NVD's 8.8 and Chromium's 'Low' rating (driven by sandbox confinement) suggests the practical priority is elevated-but-not-emergency - important to patch via normal Chrome auto-update cadence rather than a drop-everything event, absent evidence of chaining to a sandbox escape. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures an Android Chrome user (prior to 156.0.8078.47) to visit it, triggering memory corruption in the ContextMenu component. Successful exploitation could run attacker code within the renderer sandbox; no public exploit code is identified at time of analysis, and interaction (opening the page) is required per the CVSS UI:R metric. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the ContextMenu component of Google Chrome for Android allows remote attackers to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting versions prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) and no authentication (PR:N); despite a CVSS base score of 8.8, Chromium rates the issue Low because code execution is confined to the sandbox, so full device compromise would require an additional sandbox-escape primitive. No public exploit has been identified at time of analysis, and the vendor-released fixed version is Chrome 156.0.8078.47.
RemediationAI
Upgrade Google Chrome for Android to vendor-released patch version 156.0.8078.47 or later, distributed through Google Play; verify the installed version in Chrome Settings > About Chrome. No ContextMenu-specific workaround is documented, so patching is the primary fix. Until devices are updated, reduce exposure by avoiding untrusted links and crafted HTML content, and consider enterprise controls such as MDM/Play Store managed configurations that enforce a minimum Chrome version and block older releases; trade-offs include management overhead and potential disruption for users on unmanaged or older Android devices. Removing or disabling Chrome on high-risk Android devices can reduce attack surface but may remove a default browser and is operationally disruptive. Relying on the renderer sandbox limits the impact of successful memory corruption but does not prevent the flaw itself. Advisory and issue references: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html and https://issues.chromium.org/issues/562909956.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is a broad class covering out-of-bounds reads/writes and other buffer-handling errors; here the flaw is in Chrome's ContextMenu implementation on Android. The vulnerable code is reached by rendering attacker-controlled HTML, making the browser content-rendering path the attack surface. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reachability, low attack complexity, no privileges required, mandatory user interaction, unchanged scope, and high confidentiality/integrity/availability impact. Chromium's Low severity rating and the description's 'inside the sandbox' qualifier indicate that successful exploitation yields code execution in the renderer sandbox rather than direct OS-level compromise; a separate sandbox-escape vulnerability would be needed for full device takeover. The affected platform is specifically Android, and no desktop Chrome impact is indicated by the supplied data.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable crafted page with no privileges but required user interaction (UI:R); renderer code execution yields high C/I/A within the unchanged sandbox scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android versions before 156.0.8078.47 carry a high-severity memory-corruption issue in the ContextMenu component that can be triggered when a user opens a crafted HTML page. The flaw is unauthenticated but requires user interaction, and code execution is limited to the renderer sandbox; no public exploit has been identified at time of analysis, so the near-term organizational risk is primarily unpatched mobile browser exposure rather than confirmed active compromise. Leadership should care because a broad Android user base and delayed mobile patching can leave employees and BYOD devices exposed until the fixed release is enforced.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB