Chrome for Android: Memory corruption in CustomTabs
Summary
Google Chrome for Android before 156.0.8078.47 contains a memory corruption flaw in CustomTabs, the feature that shows web pages inside third-party apps. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the user opens such a page. Chromium rates the issue as Medium severity.
Affected
- Google Chrome for Android before 156.0.8078.47
Fixed in
- Google Chrome for Android 156.0.8078.47 (per the CVE record and research notes; the Google advisory entry has not been verified)
- Newer Android builds exist. Wikipedia lists 157.0.8103.14 as the Android stable version as of 22 October 2026.
Workaround
- Unknown whether Google published an interim mitigation.
- Updating Chrome is the fix. For managed devices, enforce a minimum Chrome version through MDM/UEM.
Exploitation
- No evidence of in-the-wild exploitation or a public exploit was found.
- The CISA KEV catalogue was not checked directly.
- VulDB lists a similar entry under CVE-2026-113330 and states that no exploit is available. This may be a duplicate or mirroring error.
Our recommendation
- Inventory Android devices and Chrome versions. Flag any build below 156.0.8078.47.
- Force Google Play updates on managed devices and aim for the current stable build.
- Confirm the Google advisory entry and the NVD status before closing the ticket.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Ubuntu Security: CVE-2026-113238 ubuntu.com
- Vulners: CVE-2026-113238 vulners.com
- Windows Forum: Chrome 156 security update windowsforum.com
- Wikipedia: Google Chrome en.wikipedia.org
- VulDB: CVE-2026-113330 (possible duplicate) vuldb.com
- Strix: CVE-2026-113238 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:42.
Original description (NVD)
Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.