Google Chrome for Android: Memory corruption in Extensions
Summary
A memory corruption flaw in the Extensions component of Google Chrome on Android, before 156.0.8078.47, allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, so user interaction is required. Successful exploitation does not by itself give full control of the device, because a second flaw would be needed to escape the sandbox.
Affected
- Google Chrome on Android before 156.0.8078.47
- Microsoft Edge on Android (per HKCERT; check the Edge advisory for the exact fixed version)
Fixed in
- Google Chrome on Android 156.0.8078.47 or later
Workaround
- None. Updating Chrome on Android is the remedy.
Exploitation
- No known exploitation in the sources reviewed.
- No public proof of concept found in the sources reviewed.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Chrome on Android to 156.0.8078.47 or later on all devices, including BYOD phones.
- Update Microsoft Edge on Android as well, if it is used.
- Check that managed devices receive the update through MDM or Google Play.
- Verify the installed version on a sample of devices and check the NVD record for the current CVSS score, as sources differ.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop (CVE-referenced post) chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Strix: CVE-2026-113220 www.strix.ai
- Vulners: MS:CVE-2026-113220 vulners.com
- Ubuntu security: CVE-2026-113220 ubuntu.com
- HKCERT: Microsoft Edge multiple vulnerabilities www.hkcert.org
- Google Chrome (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:54.
Original description (NVD)
Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.