CVE-2026-113169 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-6973 represents a critical memory corruption flaw within the WebAppInstalls component of Google Chrome for Android, specifically affecting versions prior to 156.0.8078.47. This security issue stems from improper handling of data structures during the installation process of web applications, which are increasingly common in modern mobile ecosystems as they bridge the gap between traditional websites and native apps. The root cause lies in a failure to properly validate or manage memory boundaries when processing specific inputs related to web app manifests or installation triggers. This type of error typically involves buffer overflows or use-after-free conditions where allocated memory is accessed after it has been freed, or written beyond its intended limits. Such flaws are particularly dangerous because they can lead to arbitrary code execution if an attacker can control the data being processed during this sensitive phase of application initialization.
From a technical perspective, the flaw allows for remote exploitation through a crafted HTML page hosted on a malicious website. When a user visits this site and interacts with elements designed to trigger the web app installation process, the vulnerable component processes malformed or specially constructed input that exploits the memory management defect. Because Chrome operates within a sandboxed environment to limit the impact of potential compromises, one might assume such vulnerabilities are contained. However, in this specific case, the nature of the memory corruption allows an attacker to bypass these sandbox restrictions. By carefully crafting the exploit payload, it is possible to overwrite critical memory structures or execute shellcode outside the restricted context, effectively gaining a higher level of privilege within the device's operating system than intended by the browser's security model.
The operational impact of this vulnerability is severe due to its remote exploitable nature and the potential for sandbox escape. An attacker does not need physical access to the victim's device or any prior authentication; they merely need to lure a user with an updated version of Chrome on Android into visiting a malicious webpage. Once executed, the arbitrary code execution can lead to full system compromise, including data theft, installation of malware, or use of the device as part of a botnet. The classification by Chromium security severity as Low reflects internal metrics regarding exploit complexity or frequency rather than the potential impact on end-users. In reality, any vulnerability that allows sandbox escape and remote code execution is considered high-risk because it undermines the fundamental isolation principles designed to protect user data and system integrity.
This incident aligns with several well-known industry standards for categorizing security weaknesses. It corresponds closely to CWE-120 Buffer Copy without Checking Size of Input Classic, or potentially CWE-416 Use After Free, depending on the exact mechanism observed in the memory corruption. Furthermore, from a tactical standpoint, this vulnerability facilitates techniques associated with MITRE ATT&CK ID T1059 Command and Scripting Interpreter, as it enables the execution of arbitrary commands within the context of the browser process before escalating to system-level privileges. It also relates to T1203 Exploitation for Client Execution, where a client-side application is tricked into running malicious code triggered by user interaction with web content.
To mitigate this risk, users must ensure that their Google Chrome application on Android devices is updated to version 156.0.8078.47 or later immediately upon availability. This patch contains the necessary fixes for the memory management logic within the WebAppInstalls component, preventing the exploitation of the underlying flaw. For organizations deploying managed browsers or enforcing mobile device management policies, it is crucial to verify that all endpoints are compliant with this version requirement. Additionally, users should exercise caution when interacting with web applications from untrusted sources, particularly those prompting for installation permissions, as these represent a common attack vector for such exploits. While technical controls like sandboxing provide significant protection, they are not infallible against sophisticated memory corruption attacks that target edge cases in complex software components like browser engines.