Live › vulnerability › CVE-2026-113277
Go to dashboardA flaw in the CustomTabs component of Google Chrome on Android lets a crafted HTML page make the browser read memory outside a buffer. The sources say the read stays inside the sandbox, so an attacker gets some memory contents rather than code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of Google Chrome on Android running a version before . Anyone who opens untrusted web pages in Chrome or in a Custom Tab from another app is in scope. Devices on a current Chrome build can skip it.
156.0.8078.47| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| google chrome | vendor | < 156.0.8078.47 | 156.0.8078.47 |
156.0.8078.47 or later.adb shell dumpsys package com.android.chrome | grep versionName where a device is attached.156.0.8078.47 or later through Google Play.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-113277")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.