Description
Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Web Origin Policy Bypass
Action: Immediate Update
AI Analysis

Impact

An attacker can exploit a released resource in the ContextMenu component of Google Chrome on Android versions earlier than 156.0.8078.47. By delivering a crafted HTML page, the attacker can circumvent the web origin policy through social engineering. This bypass may allow unauthorized access to site data and execution of malicious content within the browser’s sandbox, although it does not provide full system‑wide code execution. Chromium rates the severity of this flaw as low.

Affected Systems

Android users running Google Chrome versions earlier than 156.0.8078.47 are affected.

Risk and Exploitability

The CVSS score of 8.8 classifies this as a high‑severity vulnerability, while the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is delivery of a malicious web page to an Android device with a vulnerable Chrome build over the network.

Generated by OpenCVE AI on November 4, 2026 at 06:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Chrome update on the Android device, ensuring the build is at least 156.0.8078.47 or newer.
  • If the device cannot be updated, uninstall Chrome and use an alternative contemporary browser that is not affected by this flaw.
  • Keep an eye on future release notes and security advisories from Google to stay ahead of any additional mitigations or patches.

Generated by OpenCVE AI on November 4, 2026 at 06:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 07:00:00 +0000

Type Values Removed Values Added
Title Chrome Android ContextMenu Resource Leak Enables Web Origin Policy Bypass

Wed, 04 Nov 2026 01:45:00 +0000

Type Values Removed Values Added
Title Memory corruption in ContextMenu allows remote code execution on Android Chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-672

Fri, 23 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Thu, 22 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 22 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Title Memory corruption in ContextMenu allows remote code execution on Android Chrome

Tue, 20 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-119
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:21:16.379Z

Reserved: 2026-10-19T23:00:20.667Z

Link: CVE-2026-113121

cve-icon Vulnrichment

Updated: 2026-10-20T22:48:54.271Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:04.227

Modified: 2026-11-03T22:18:35.433

Link: CVE-2026-113121

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T06:45:08Z

Weaknesses
  • CWE-672

    Operation on a Resource after Expiration or Release