CVE-2026-113276 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2023-9999, affecting Google Chrome on Android prior to version 156.0.8078.47, represents a critical memory corruption flaw within the browser's password management subsystem. This defect allows for potential arbitrary code execution by remote attackers through specially crafted HTML pages. The issue stems from improper handling of data structures associated with stored credentials or autofill mechanisms, leading to conditions such as buffer overflows or use-after-free scenarios when processing maliciously formatted input. Such memory corruption vulnerabilities are particularly dangerous because they can bypass standard security boundaries if the attacker successfully exploits the flaw within a context that has elevated privileges relative to the sandboxed renderer process.
From a technical perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific memory management error involved in the password handling logic. The Chromium security team classified this issue as Medium severity, indicating that while exploitation requires careful crafting of a web page to trigger the flaw, it does not necessarily require complex user interaction beyond visiting a malicious site or being redirected via phishing techniques. The attack vector is categorized under Remote Code Execution (RCE) through Web Content, which corresponds to MITRE ATT&CK technique T1059 Command and Scripting Interpreter if the execution leads to script-based control, or more broadly to Initial Access vectors involving Drive-by Compromise where a user visits a compromised website.
The operational impact of this vulnerability is significant due to its potential for privilege escalation within the browser's architecture. Although Chrome employs sandboxing to limit the damage from renderer process compromises, successful exploitation could allow an attacker to escape the sandbox or execute code with higher privileges depending on how the password module interacts with system-level APIs or other privileged processes. This could lead to unauthorized access to sensitive user data, including saved passwords and credit card information stored in Chrome's vaults. Furthermore, it enables attackers to perform further malicious activities such as session hijacking, credential theft, or installing persistent malware by leveraging the compromised browser instance as a foothold within the device ecosystem.
Mitigation strategies primarily involve immediate software updates to ensure users are running version 156.0.8078.47 or later of Google Chrome on Android. Organizations should enforce automatic update policies for all employee devices to minimize exposure windows. Additionally, security awareness training is recommended to educate users about the risks of visiting untrusted websites and clicking on suspicious links that may host exploit kits targeting browser vulnerabilities. Implementing content security policies (CSP) where applicable can also help mitigate some aspects of web-based attacks by restricting script execution sources. Regular vulnerability scanning and patch management processes are essential components of a robust defense-in-depth strategy to protect against such memory corruption flaws in widely used software applications like Google Chrome.