CVE-2026-113180 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-6973 represents a critical memory corruption flaw within the ContentCapture component of Google Chrome for Android, specifically affecting versions prior to 156.0.8078.47. This defect allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a specially crafted HTML page. The issue stems from improper handling of memory operations within the ContentCapture module, which is responsible for managing content extraction and processing tasks such as capturing text or images from web pages. When an attacker constructs a malicious webpage that triggers specific edge cases in this component, it can lead to heap corruption or buffer overflow conditions. These types of memory errors are particularly dangerous because they disrupt the normal flow of program execution and can be exploited to inject and run arbitrary shellcode within the context of the browser process.
From a technical perspective, this vulnerability falls under the category of improper input validation leading to memory safety violations. In modern web browsers like Chrome, security is heavily reliant on sandboxing mechanisms that isolate different processes from one another to limit the damage caused by successful exploits. However, when a vulnerability exists within a component running with elevated privileges or sufficient access to shared resources, such as ContentCapture, an attacker can potentially bypass these isolation boundaries. The exploitation of this flaw likely involves crafting HTML and JavaScript payloads that manipulate internal data structures in ways not anticipated by the developers. By triggering the memory corruption, the attacker gains control over critical pointers or return addresses, allowing them to redirect execution flow to their own malicious code. This aligns with common attack patterns described in industry standards such as CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, which highlight the risks associated with unchecked memory operations.
The operational impact of this vulnerability is significant due to its potential for remote code execution via a simple web visit. An attacker does not need physical access or prior authentication; they only need to host a malicious webpage that can be accessed through phishing links, drive-by downloads, or compromised advertising networks. Once the victim visits the page and triggers the exploit, arbitrary code runs within the Chrome sandbox. While the sandbox provides some protection against full system compromise, it does not prevent all forms of data exfiltration or further lateral movement. The attacker could potentially access sensitive user data stored in cookies, local storage, or cached content associated with other tabs. Furthermore, successful exploitation might serve as a stepping stone for more advanced attacks, such as escaping the sandbox entirely to gain higher-level system privileges, although this would require additional vulnerabilities and complex chaining techniques.
In terms of threat intelligence frameworks, this vulnerability maps closely to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically within the context of web browsers where JavaScript is used to facilitate exploitation. It also relates to T1203 File Execution via Web Browser, as the ultimate goal is often to execute malicious payloads on the target device. The severity rating from Chromium security teams was classified as Low, which typically indicates that while the vulnerability exists and can be exploited, it may require specific conditions or user interaction beyond simple page loading, such as enabling certain flags or interacting with specific UI elements. However, given the widespread use of Chrome for Android, even low-severity vulnerabilities in core components like ContentCapture pose a substantial risk to the broader ecosystem due to their potential impact on millions of devices.
To mitigate this vulnerability, users must ensure that Google Chrome is updated to version 156.0.8078.47 or later on Android devices. This update contains patches for the memory handling issues within ContentCapture that prevent the exploitation of these flaws. Organizations should enforce automatic updates where possible and monitor device compliance with current browser versions. Additionally, implementing strict content security policies can help reduce the risk of successful exploitation by limiting the types of scripts and resources that browsers are allowed to execute from untrusted sources. Security awareness training for end-users is also crucial, as social engineering tactics often accompany such exploits to lure victims into visiting malicious sites. Regular patch management cycles remain the most effective defense against known vulnerabilities in widely deployed software components like web browsers.