Google Chrome for Android: Memory corruption in Voice component
Summary
Memory corruption in the Voice component of Google Chrome for Android before 156.0.8078.47 can be triggered by a crafted HTML page. A remote attacker can use it to execute arbitrary code inside the browser sandbox. The attack requires the victim to open the malicious page; the sandbox limits the impact, and CVSS rates it 8.8 (High).
Affected
- Google Chrome for Android before 156.0.8078.47
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Fixed in
- Update to Google Chrome 156.0.8078.47 or later for Android
- Later Android builds may exist; install the newest build available
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Confirm all Android devices with Chrome run 156.0.8078.47 or later, preferably the newest build
- Check MDM or Google Play update policies for devices that lag behind
- Restrict browsing on unmanaged or BYOD devices where possible
- Monitor the Chromium bug tracker and CISA KEV for changes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 500497398 issues.chromium.org
- Microsoft Security Update Guide CVE-2026-113164 msrc.microsoft.com
- NVD record via Vulners vulners.com
- Ubuntu CVE tracker ubuntu.com
- Strix CVE-2026-113164 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:22.
Original description (NVD)
Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.