Google Chrome for Android: Range error in SiteIsolation allows sandbox code execution
Summary
A range error in SiteIsolation, Chrome's per-site process separation, affects Google Chrome on Android before 156.0.8078.47. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the user must open the page. The CVSS score is 8.8, while Google rates the bug Medium, and no exploitation is known.
Affected
- Google Chrome for Android before 156.0.8078.47
Fixed in
- Google Chrome for Android 156.0.8078.47 or later
Workaround
- No vendor workaround known. Update Chrome for Android.
Exploitation
- No known exploitation according to the sources. CISA SSVC: exploitation none, not automatable.
Our recommendation
- Update Chrome for Android to 156.0.8078.47 or later via Google Play or MDM.
- Check the Chrome version on all company and BYOD phones and make sure Play auto-update is enabled.
- Report devices that still run older builds and prioritise phones used for email or browsing.
- Treat this as part of the standard monthly patch cycle, not an emergency change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- NVD record via Vulners vulners.com
- Strix CVE entry CVE-2026-113239 www.strix.ai
- Windows Forum: Chrome 156 security update windowsforum.com
- TechGeeks security notice Chrome 156 www.techgeeks.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:43.
Original description (NVD)
Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.