Live › vulnerability › CVE-2026-113225
Go to dashboardA memory corruption bug in the Browser component of Google Chrome on Android lets a remote attacker read memory inside the sandbox when the victim opens a crafted HTML page. The attacker can potentially read data from the browser process sandbox but the sources do not report code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any device running Google Chrome on Android before is affected, and exposure comes from browsing to a malicious page. Fleet owners should check managed Android devices. Devices already on or later are not affected.
156.0.8078.47156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
adb shell dumpsys package com.android.chrome | grep versionName156.0.8078.47156.0.8078.47 or later through the Play StoreEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memory corruption in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
This page as .md · .json · in your agent: get_signal("CVE-2026-113225")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.