CVE-2026-113156 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free condition within Google Chrome for Android, specifically in versions prior to 156.0.8078.47, represents a critical memory management flaw that compromises the integrity of the browser's sandboxing mechanisms. This type of error occurs when a program continues to use a pointer after it has been freed from memory, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the vulnerability resides within the Messages component or related rendering engines used in Chromium-based browsers on Android devices. The severity is classified as Low by Chromium security standards, yet its potential impact remains significant due to the nature of code execution capabilities it enables.
The technical flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. This typically involves constructing a web page that triggers specific JavaScript operations or DOM manipulations designed to exploit the timing window between memory deallocation and subsequent access. By carefully crafting the payload, an attacker can manipulate heap structures such that freed memory is reused for malicious purposes, potentially allowing control over program flow or data integrity. The sandbox environment, while intended to isolate web content from the host system, relies heavily on correct memory handling; when this foundation is compromised via use-after-free vulnerabilities, the isolation guarantees are weakened, enabling privilege escalation within the browser context itself.
From an operational perspective, successful exploitation of this vulnerability could lead to unauthorized access to sensitive user data stored locally on the Android device or facilitate further attacks against other applications running with similar permissions. Although classified as low severity, such vulnerabilities often serve as stepping stones in complex attack chains where multiple flaws are chained together to achieve full system compromise. The ability to execute arbitrary code within the sandbox means that attackers could potentially bypass security controls designed to prevent malicious script execution, leading to data exfiltration or installation of persistent malware on affected devices.
Mitigation strategies primarily involve updating Google Chrome for Android to version 156.0.8078.47 or later, which includes patches addressing this memory management issue. Users should ensure automatic updates are enabled to receive security fixes promptly. Additionally, employing browser extensions that restrict script execution on untrusted sites can provide an additional layer of defense against crafted HTML pages designed to exploit such vulnerabilities. Security teams monitoring Android environments should prioritize patching these devices and educate users about the risks associated with visiting suspicious or poorly secured websites.
This vulnerability aligns with CWE-416, which describes use after free errors, a common class of software defects that lead to crashes or arbitrary code execution. In terms of attack tactics, this scenario corresponds to ATT&CK technique T1059, specifically command and script interpretation via JavaScript, as the attacker utilizes web technologies to execute malicious commands within the browser environment. Understanding these mappings helps in developing more robust detection rules and defensive postures against similar memory corruption vulnerabilities across different platforms and applications.