CVE-2026-113170 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described constitutes a critical memory safety flaw within the Autofill component of Google Chrome on Android, specifically affecting versions prior to 156.0.8078.47. This issue is classified as an out-of-bounds write or use-after-free condition, which represents one of the most dangerous classes of software defects in modern application development. The root cause lies in improper memory management where a pointer continues to reference a memory location after that space has been freed and potentially reallocated for other purposes. In the context of Chrome's Autofill feature, this flaw allows an attacker who crafts a malicious HTML page to trigger specific code paths that manipulate these dangling pointers. When the browser attempts to access or modify data through these invalid references, it leads to undefined behavior that can be exploited to overwrite adjacent memory structures with controlled values.
From a technical perspective, use-after-free vulnerabilities are particularly severe because they provide attackers with significant control over program execution flow. By carefully crafting the payload within the HTML page, an attacker can manipulate the contents of the freed memory block before it is reused. This manipulation allows for arbitrary code execution by redirecting function pointers or return addresses to malicious shellcode injected into the process memory space. Although Chrome employs robust sandboxing mechanisms designed to limit the impact of such exploits, a successful exploitation of this vulnerability could allow an attacker to escape the browser's security boundaries and execute commands with the privileges of the user running the application. The Chromium project has assigned this issue a medium severity rating, reflecting its potential for remote code execution while acknowledging the mitigating factors present in Chrome’s architecture.
The operational impact of this vulnerability is substantial, as it enables remote attackers to compromise device integrity without any physical access or prior authentication. A victim merely needs to visit a maliciously crafted website hosted by an adversary to trigger the exploit. Once executed, the attacker gains arbitrary code execution capabilities within the browser process. This can lead to data theft, installation of persistent malware, or further lateral movement if the sandbox is successfully breached. The attack vector falls squarely under the ATT&CK technique for Drive-by Code Execution, where software vulnerabilities are exploited during normal web browsing activities without user interaction beyond visiting a webpage. Additionally, this flaw aligns with CWE-416, Use After Free, which highlights the failure to properly manage memory deallocation and subsequent access checks in C++ based applications like Chrome.
Mitigation strategies primarily involve immediate patching of the affected software version. Users running Google Chrome on Android must update to version 156.0.8078.47 or later to resolve this issue, as the vendor has implemented fixes that ensure proper memory lifecycle management and prevent access to freed resources. For organizations managing multiple devices, enforcing automated update policies is critical to reduce exposure windows. Furthermore, while technical controls like sandboxing provide a layer of defense, they are not foolproof against sophisticated exploits targeting complex components like Autofill. Therefore, combining timely patching with user education regarding suspicious links and websites remains essential for comprehensive protection against such remote exploitation attempts.