CVE-2026-113083 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a memory corruption flaw within the Actor component of Google Chrome on Android, specifically affecting versions prior to 156.0.8078.47. This issue stems from improper handling of data structures during the execution of web content, allowing for out-of-bounds access or use-after-free conditions when processing crafted HTML pages. The root cause lies in a failure by the browser engine to properly validate memory boundaries or object lifecycles before performing operations on actor-managed resources. Such errors are characteristic of low-level programming mistakes where pointer arithmetic or reference counting mechanisms fail, leading to undefined behavior that can be exploited to compromise application integrity.
From an operational perspective, this vulnerability enables a remote attacker to execute arbitrary code within the browser's sandboxed environment. While Chrome employs multiple layers of security isolation, including site isolation and process separation, successful exploitation allows the attacker to bypass these controls at least partially by gaining execution privileges inside the renderer process. The Chromium project has classified this issue with a Low severity rating, indicating that while the vulnerability is real and exploitable, it may require specific conditions or limited impact compared to higher-severity flaws like those allowing full sandbox escape. However, even low-severity memory corruption issues can serve as stepping stones for more complex attacks if combined with other vulnerabilities or used in conjunction with social engineering tactics to trick users into visiting malicious sites.
The technical implications of this flaw align closely with CWE-125, which describes Out-of-Bounds Read conditions, and potentially CWE-416, Use After Free, depending on the specific nature of the memory corruption observed during exploitation attempts. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques related to Initial Access via Spearphishing Link or Drive-by Compromise, where a victim is lured into loading malicious content that triggers the exploit chain. The ability to execute arbitrary code within the sandbox also touches upon lateral movement and privilege escalation vectors if additional vulnerabilities are present in adjacent processes or system components.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 156.0.8078.47 or later, which includes patches for this memory management error. Administrators should ensure that automatic updates are enabled to maintain protection against known exploits. For users unable to update immediately, employing strict content security policies and disabling JavaScript execution in untrusted environments can reduce the attack surface. Additionally, utilizing browser extensions that block suspicious scripts or enforce stricter sandboxing rules may provide an additional layer of defense until the software is fully patched. Continuous monitoring for anomalous behavior within the browser process and keeping operating system dependencies up to date further hardens the environment against exploitation attempts leveraging this specific flaw.