A memory corruption flaw in the Extensions component of Google Chrome on Android, before 156.0.8078.47, allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so user interaction is required. Successful exploitation does not by itself give full control of the device, because a second flaw would be needed to escape the sandbox.
Google · Chrome for Android
Google Chrome desktop versions before 156.0.8078.47 contain a memory corruption flaw in the Contacts component (CWE-119). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page, and a full compromise would also need a sandbox escape.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability in the DataTransfer component. A remote attacker can exploit it by luring a user to a crafted HTML page, which can execute arbitrary code inside the browser sandbox. Google rates the Chromium severity as Medium, while the CVSS base score is 8.8 (High).
Google · Chrome
A use-after-free vulnerability in the WebAppInstalls component of Google Chrome on Android allows a remote attacker to execute arbitrary code inside the sandbox. The attacker needs a victim to open a crafted HTML page, so user interaction is required. The NVD description places the code execution inside the sandbox, so full control of the device is not implied by this issue alone. Chromium rates it High, and CVSS 3.1 scores it 8.8.
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a use-after-free flaw in the Navigation component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens the page, and the CVSS base score is 8.8 (High).
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw (CWE-416) in the Extensions component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox, provided a user visits the page. Google rates the issue Low internally, while NVD lists a CVSS 3.1 base score of 8.8. Exploitation in the wild is not known.
Google · Chrome
Improper input validation in the FullScreen component of Google Chrome before 156.0.8078.47 could allow a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so user interaction is required. Google rates the issue with Chromium security severity Low, and the CVSS base score is 8.8.
Google · Chrome
Memory corruption in the DevTools component of Google Chrome desktop versions before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker only needs the victim to open a crafted HTML page, which requires no login. NVD rates the issue 8.8 (High) under CVSS 3.1, while Google rates the upstream Chromium issue Low. Code execution outside the sandbox usually requires a second vulnerability.
Google · Chrome
Google Chrome desktop versions prior to 156.0.8078.47 contain a memory corruption flaw in ServiceWorker (CWE-119). A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Exploitation requires that a user visits the crafted page; Google rates the issue Medium, while NVD lists a CVSS 3.1 score of 9.6 (Critical) in the supplied data.
Google · Chrome
Google Chrome on Windows contains a use-after-free flaw (CWE-416) in ANGLE, the graphics translation layer. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the user must visit the page. A full compromise would additionally require a sandbox escape. Microsoft Edge, which is Chromium-based, is reported to be affected by the same bug.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw (CWE-416) in the ContextualSearch component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so the risk comes from normal web browsing and links in email. The CVSS 3.1 base score is 8.8 (High), and Google rates the Chromium severity as Medium.
Google · Chrome
A use-after-free flaw in SiteIsolation, Chrome's process isolation component, affects Chrome for Android before 156.0.8078.47. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no login is required. Sandbox escape is not described in the CVE record.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the Omnibox (address bar). A remote attacker can execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. No login is required, but the victim must open the page, for example through a phishing link or malicious advertisement. The description limits the impact to code execution inside the sandbox, so a full system compromise would require a separate sandbox escape.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the Variations component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page. Chromium rates the issue Medium, and NVD assigns a CVSS 3.1 base score of 8.8.
Google · Chrome
A use-after-free vulnerability (CWE-416) in the TrustedWebActivities component of Google Chrome for Android allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, for example via a link in email or messaging. No authentication is required, and the CVSS base score is 8.8 (High).
Google · Chrome for Android
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw in the CSS engine (CVE-2026-113203, CWE-416). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and no privileges are needed. Google rates the flaw Medium; NVD and MSRC score it CVSS 8.8.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free flaw (CWE-416) in the BrowserTag component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user opens the malicious page; no privileges are needed. Google rates the severity as Medium in Chromium.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw (CWE-416) in the ANGLE graphics component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a user to open a crafted HTML page, so no authentication is required. The CVE data does not describe a sandbox escape, so full system compromise is not covered by this CVE.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions prior to 156.0.8078.47 contain a use-after-free flaw in the Extensions component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The victim must open the malicious page, and no privileges or exposed services are required.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability (CWE-416) in the Forms component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attacker needs no authentication, but the victim must visit the page. Full system compromise would normally require an additional sandbox escape.
Google · Chrome
Google Chrome versions prior to 156.0.8078.47 contain an improper input validation flaw in the Downloads component. A remote attacker who lures a user to a crafted HTML page could potentially execute arbitrary code inside the browser sandbox. The attack requires user interaction (opening the page) but no prior authentication. The Chromium security severity is Medium, and the CVSS 3.1 base score in the CVE data is 8.8.
Google · Chrome
A memory corruption flaw in the Core component of Google Chrome before 156.0.8078.47 could let a remote attacker execute arbitrary code inside the browser sandbox. The attacker needs a user to visit a crafted HTML page, and no authentication is required. The CVE record describes impact limited to the sandbox and does not describe a sandbox escape.
Google · Chrome
