Google Chrome for Android: Out-of-bounds read in Core component
Summary
Google Chrome for Android before 156.0.8078.47 contains an out-of-bounds read in the Core component (CWE-125). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the page, and the sources do not confirm whether a further sandbox escape is needed for full compromise.
Affected
- Google Chrome for Android prior to 156.0.8078.47
- Desktop platforms are not the subject of this CVE according to its text
Fixed in
- Chrome for Android 156.0.8078.47 or later (per secondary reporting; Google's Android-specific entry could not be verified)
- Later Android builds (for example 156.0.8078.79 or Android 157) are expected to include the fix, but this was not verified
Workaround
- Unknown. No vendor-documented workaround found; updating is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- CISA KEV: a third-party tracker lists it as not included; not verified against CISA.
- No public proof of concept found in the research; this does not prove none exists.
Our recommendation
- Update Chrome for Android to the current 156.x or 157.x build via Google Play.
- Enforce a minimum Chrome version via MDM on managed devices and verify auto-update is not blocked.
- Prioritise devices with disabled updates or outdated Android versions, and monitor for further reports.
- Note that CVSS 8.8 (high) conflicts with Chromium's Medium severity; plan according to the higher rating for Android staff.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- Ubuntu security tracker CVE-2026-113233 ubuntu.com
- Vulners CVELIST record CVE-2026-113233 vulners.com
- Vulners Red Hat record CVE-2026-113233 vulners.com
- Strix CVE-2026-113233 summary www.strix.ai
- Chrome 156 stable what's new (ChromeGeek) www.chromegeek.com
- Chrome 156 security update fixes (WindowsForum) windowsforum.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:51.
Original description (NVD)
Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.