Description
Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential sandbox memory read and web origin policy bypass via crafted HTML page
Action: Update Chrome
AI Analysis

Impact

Information loss occurs when Chrome parses PDF files on Android devices prior to 156.0.8078.47. A crafted HTML page can trigger the flaw, allowing a remote attacker to bypass the web origin policy.

Affected Systems

The flaw affects Google Chrome for Android versions prior to 156.0.8078.47. Any device running a pre‑156.0.8078.47 build is susceptible until patched.

Risk and Exploitability

Exploitability depends on delivering a crafted PDF within an HTML page, indicating a remote attack vector. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Given its CVSS score of 6.5 and the need for a specialized payload, the overall risk is moderate.

Generated by OpenCVE AI on November 4, 2026 at 12:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 156.0.8078.47 or newer on all Android devices
  • Disable or block PDF loading in Chrome via device policy or content settings
  • Monitor for anomalous behavior and apply additional endpoint protection if needed

Generated by OpenCVE AI on November 4, 2026 at 12:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 13:00:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome Android PDF Parser Enables Remote Sandbox Memory Read

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Information loss in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-221

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Memory Corruption in Chrome Android PDF Parser Enables Remote Sandbox Memory Read

Wed, 21 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Google chrome

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in PDF in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:36.582Z

Reserved: 2026-10-19T22:51:23.894Z

Link: CVE-2026-113026

cve-icon Vulnrichment

Updated: 2026-10-21T15:13:38.427Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:53.497

Modified: 2026-11-03T22:18:16.793

Link: CVE-2026-113026

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T12:45:14Z

Weaknesses
  • CWE-221

    Information Loss or Omission