CVE-2026-113217 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free error within the WebAppInstalls component of Google Chrome for Android represents a critical memory management flaw that compromises the integrity and confidentiality of the browser environment. This specific defect occurs when an object is deallocated from memory but continues to be referenced by other parts of the application, leading to undefined behavior upon subsequent access. In this context, the vulnerability resides in the logic governing web application installations, which handles complex interactions between the operating system and the browser engine during the process of adding progressive web apps or similar installable content to a device. The severity is classified as high due to the potential for remote code execution within the sandboxed environment that typically isolates web content from the underlying host system.
From a technical perspective, use-after-free vulnerabilities arise when pointers are not properly invalidated after memory release, allowing an attacker to manipulate heap structures or execute arbitrary instructions through dangling references. A remote attacker can exploit this flaw by crafting a malicious HTML page designed to trigger the specific sequence of events that leads to premature deallocation followed by access. When Chrome processes this crafted content on Android devices running versions prior to 156.0.8078.47, it may interpret freed memory as valid data or executable code. This misinterpretation allows for arbitrary code execution within the browser's sandbox, which is a restricted environment designed to limit the damage an attacker can cause if they successfully compromise the process.
The operational impact of this vulnerability extends beyond simple data corruption. Successful exploitation enables a remote adversary to bypass security boundaries and execute commands with the privileges granted to the Chrome process on Android. While modern browsers employ multiple layers of defense such as sandboxing, address space layout randomization, and control flow integrity checks, these measures are not impenetrable against sophisticated heap manipulation techniques associated with use-after-free bugs. An attacker leveraging this flaw could potentially install malware, exfiltrate sensitive user data stored within the browser profile, or pivot to further attacks on the host device if additional vulnerabilities exist that allow escaping the sandbox entirely.
This incident aligns closely with Common Weakness Enumeration identifier CWE-416, which describes use-after-free conditions as a significant category of memory safety errors prevalent in C and C++ based software like Chromium. Furthermore, from an offensive security perspective, this vulnerability facilitates techniques categorized under MITRE ATT&CK framework related to initial access via browser exploitation and subsequent privilege escalation or lateral movement depending on the success of sandbox escape attempts. The existence of such flaws underscores the complexity of maintaining memory safety in large-scale codebases where manual memory management is still utilized alongside modern safeguards.
Mitigation strategies primarily involve updating Google Chrome for Android to version 156.0.8078.47 or later, which includes patches that correct the lifecycle management of objects within the WebAppInstalls module. Developers and security teams should ensure automated patching mechanisms are in place to minimize exposure windows. Additionally, users can reduce risk by disabling JavaScript execution on untrusted sites or using browser extensions that enforce stricter content policies until updates propagate across all devices. Continuous monitoring for anomalous behavior originating from web processes and keeping operating system components up to date further hardens the environment against exploitation of memory corruption vulnerabilities like this one.