CVE-2026-113092 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as CVE-2023-XXXX, affecting Google Chrome on Android prior to version 156.0.8078.47, represents a critical memory safety failure classified under the CWE category of Use After Free (CWE-416). This specific flaw resides within the password management subsystem of the browser engine, which is responsible for storing and retrieving user credentials securely. The core technical issue arises when the application fails to properly manage the lifecycle of memory objects associated with password data structures. Specifically, a pointer to an object that has already been deallocated or freed by the system remains accessible and usable within the code execution flow. This state violation occurs because the reference count was not correctly maintained or checked before access, allowing the program to interact with memory regions that are no longer validly owned by the application process.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a crafted HTML page. An attacker can construct a malicious webpage containing specially designed JavaScript and DOM elements that trigger the specific code path where the use-after-free condition exists. When an Android user visits this compromised site, potentially through social engineering or drive-by download tactics, the browser processes the malformed input while handling password-related operations such as autofill suggestions or credential validation checks. Because Chrome on Android operates within a sandboxed environment to limit the blast radius of exploits, the significance of achieving arbitrary code execution is heightened significantly. Successfully exploiting this flaw allows an attacker to bypass these isolation mechanisms and execute arbitrary machine code with the privileges of the browser process. This can lead to full device compromise, including access to sensitive user data stored locally on the Android device such as saved passwords, session cookies, and personal information.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to initial exploitation through web-based delivery (T1189) and subsequent privilege escalation or sandbox escape if the memory corruption allows for control of execution flow pointers like return addresses or function vtables. The high severity rating assigned by Chromium security reflects the ease with which such memory errors can be leveraged in modern exploit development chains, often combined with other vulnerabilities to achieve stable code execution on mobile operating systems where mitigation layers may differ from desktop counterparts.
Mitigation for this vulnerability requires immediate action by end-users and system administrators. The primary remediation is to update Google Chrome on Android devices to version 156.0.8078.47 or later, which contains the necessary patches to correct memory management logic within the password module. Organizations should enforce mobile device management policies that ensure browsers are kept up-to-date automatically where possible. Additionally, users should exercise caution when interacting with untrusted web content and consider enabling enhanced security features such as Safe Browsing protections to mitigate risks associated with malicious sites attempting to exploit browser vulnerabilities. Regular auditing of installed applications and keeping the underlying Android operating system patched also contributes to a stronger defense-in-depth posture against memory corruption attacks.