Description
Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-11-03
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A privilege‑elevation flaw exists in the Contacts component of Google Chrome on Android devices. The vulnerability enables a malicious party to execute arbitrary code outside of the browser sandbox by loading a specially crafted HTML page, potentially granting the attacker full control over the device.

Affected Systems

Google Chrome on Android, versions earlier than 157.0.8103.38, is affected. Users running the stable channel of Chrome before the 157.0.8103.38 update are at risk.

Risk and Exploitability

The CVE carries a medium severity rating from Chromium. Explicit exploit probability data (EPSS) is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to lure a user to an attacker‑controlled web page or otherwise trick the user into rendering malicious content. Once the crafted HTML is processed, the attacker could run code with elevated privileges, bypassing Chrome’s sandbox protections.

Generated by OpenCVE AI on November 3, 2026 at 22:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome on Android to version 157.0.8103.38 or newer. This version contains the patch that removes the privilege escalation path.
  • Block or remove the Contacts permission for Chrome on the device through the Android permissions manager, limiting the app’s ability to access contact data that could be used in the attack.
  • Monitor and restrict access to untrusted web content; consider using enterprise or device‑level web filtering to prevent the delivery of malicious HTML that could exploit this flaw.

Generated by OpenCVE AI on November 3, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Contacts in Chrome Android Allows Remote Code Execution

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-250
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:22:04.155Z

Reserved: 2026-11-03T10:33:43.885Z

Link: CVE-2026-121234

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:33.503

Modified: 2026-11-03T22:19:44.597

Link: CVE-2026-121234

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:00:08Z

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges