Description
Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Based on the updated description, the vulnerability involves improper input validation in the Omnibox component of Google Chrome on Android. A local attacker who can co‑install an app and use social engineering can bypass the web origin policy, corrupt browser memory, and potentially execute arbitrary code within the Chrome sandbox. This flaw is identified as CWE‑20.

Affected Systems

The vulnerability affects versions of Google Chrome for Android released before 156.0.8078.47. Devices running those earlier builds are at risk while using the browser, regardless of other security settings.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. Exploitation requires a local attacker able to install a companion app or convince a user via social engineering. Successful exploitation corrupts browser memory, allowing code execution inside the Chrome sandbox. The EPSS score is <1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on November 4, 2026 at 06:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome on Android to 156.0.8078.47 or newer, which contains the patched Omnibox logic.
  • Ensure that automatic updates are enabled so future patches are applied promptly.
  • If a device cannot be updated immediately, consider restricting access to the affected browser or using a more recent trusted browser until the Chrome version is upgraded.

Generated by OpenCVE AI on November 4, 2026 at 06:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 07:00:00 +0000

Type Values Removed Values Added
Title Omnibox Memory Corruption Enabling Remote Code Execution in Chrome on Android

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)
Weaknesses CWE-20

Thu, 22 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Omnibox Memory Corruption Enabling Remote Code Execution in Chrome on Android

Wed, 21 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Google chrome

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:53.576Z

Reserved: 2026-10-19T22:51:43.228Z

Link: CVE-2026-113032

cve-icon Vulnrichment

Updated: 2026-10-20T23:06:06.870Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:54.173

Modified: 2026-11-03T22:18:17.997

Link: CVE-2026-113032

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T06:45:08Z

Weaknesses
  • CWE-20

    Improper Input Validation