CVE-2026-113164 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-6933 represents a critical memory corruption flaw within the Voice component of Google Chrome on Android, specifically affecting versions prior to 156.0.8078.47. This defect allows for arbitrary code execution by leveraging improper handling of data structures in memory. The root cause lies in how the browser processes specific inputs related to voice processing features, where a lack of sufficient boundary checks or type validation leads to invalid memory operations. Such flaws are typically categorized under CWE-120 Buffer Overflow or CWE-787 Out-of-bounds Write depending on the precise nature of the corruption observed during exploitation attempts. The severity is classified as Medium by Chromium security standards because while it enables code execution, it operates within the browser's sandboxed environment which provides some mitigation against full system compromise.
An attacker can exploit this vulnerability by hosting a specially crafted HTML page that triggers the flawed memory handling logic when accessed via Chrome on Android. When a victim visits this malicious webpage, the embedded content interacts with the Voice component in an unexpected manner, causing the application to write data beyond allocated buffer limits or access freed memory regions incorrectly. This manipulation corrupts adjacent memory structures such as function pointers or object headers, which can subsequently be hijacked by the attacker to redirect execution flow. The attack vector is remote and requires user interaction only in the sense of visiting a webpage, making it highly feasible for phishing campaigns or drive-by download scenarios where social engineering prompts users to navigate to malicious sites.
The operational impact of this vulnerability extends beyond simple data leakage as it permits arbitrary code execution within the browser's sandboxed process. While modern browsers employ multiple layers of defense including ASLR DEP and site isolation, successful exploitation can still lead to significant security breaches. An attacker could potentially escalate privileges by chaining this memory corruption with other vulnerabilities or exploiting weaknesses in the sandbox escape mechanisms. This could result in unauthorized access to sensitive user data stored locally on the device such as cookies credentials and browsing history. Furthermore it opens pathways for installing persistent malware or using the compromised browser instance as a pivot point for further network attacks within connected environments.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later where these memory handling issues have been resolved through rigorous code review and fuzzing efforts. Users should ensure automatic updates are enabled to receive security patches promptly as they become available. For enterprise environments implementing mobile device management solutions it is advisable to enforce minimum browser version policies across all managed Android devices. Additionally employing content security policies and restricting the execution of untrusted scripts can reduce the attack surface even if a vulnerability exists in the underlying engine. Security teams should also monitor for indicators of compromise related to unusual memory usage patterns or unexpected network connections originating from Chrome processes which may signal active exploitation attempts targeting this specific flaw.