Description
Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-27
Score: n/a
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Apply Update
AI Analysis

Impact

Improper input validation in the Core component of Google Chrome on Android prior to version 156.0.8078.73 could allow a remote attacker to craft an HTML page that enables execution of arbitrary code outside the browser sandbox. This flaw, identified as CWE‑20, compromises the confidentiality, integrity, and availability of the device.

Affected Systems

Google Chrome for Android, versions prior to 156.0.8078.73.

Risk and Exploitability

The vulnerability is rated High by Chromium security standards. Since the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the exact exploitation likelihood is unclear, but the attack vector is inferred to be a remote attacker delivering a malicious HTML page to a user’s device.

Generated by OpenCVE AI on October 28, 2026 at 00:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 156.0.8078.73 or newer on all Android devices.
  • Enable automatic updates to ensure future patches are applied promptly.
  • Avoid opening or interacting with untrusted or suspicious HTML content on outdated Chrome installations.

Generated by OpenCVE AI on October 28, 2026 at 00:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 28 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Validation in Android Chrome

Tue, 27 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-27T23:03:12.843Z

Reserved: 2026-10-27T21:25:32.687Z

Link: CVE-2026-118321

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T23:17:00.733

Modified: 2026-10-27T23:17:00.733

Link: CVE-2026-118321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:00:17Z

Weaknesses
  • CWE-20

    Improper Input Validation