{"id":"CVE-2026-118321","kind":"vulnerability","aliases":["CVE-2026-118321"],"related":[],"title":"Chrome on Android: input validation flaw lets crafted page escape sandbox","description":"Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"Improper input validation in the Core component of Google Chrome on Android, before 156.0.8078.73, lets a remote attacker run code outside the browser sandbox. The attack is triggered by a crafted HTML page the victim opens.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","browsers","chrome","mobile","runtime"],"not_affected_if":["already-on-156.0.8078.73","desktop-only"],"how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome, or run `adb shell dumpsys package com.android.chrome | grep versionName` from a workstation\n- Compare the reported version against `156.0.8078.73`; anything lower is affected","fix":"- Update Google Chrome on Android to `156.0.8078.73` or later through the Play Store\n- Update any WebView-based apps that bundle or depend on the Chromium WebView component, if the sources or vendor notes apply to them (unknown from the sources)","status":"open","published_at":"2026-10-27T23:17:00+00:00","first_seen_at":"2026-10-27T23:29:43+00:00","triaged_at":"2026-10-27T23:31:58+00:00","updated_at":"2026-10-27T23:31:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-27T23:31:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome on Android to `156.0.8078.73` or later through the Play Store\n- Update any WebView-based apps that bundle or depend on the Chromium WebView component, if the sources or vendor notes apply to them (unknown from the sources)","reach":"internet","title":"Chrome on Android: input validation flaw lets crafted page escape sandbox","impact":"high","summary":"Improper input validation in the Core component of Google Chrome on Android, before 156.0.8078.73, lets a remote attacker run code outside the browser sandbox. The attack is triggered by a crafted HTML page the victim opens.","category":"runtime","nicknames":[],"who_cares":["chrome","android","mobile","browsers"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code outside the browser sandbox after the victim visits a page","analyst_note":"Sources give only NVD text and a Chromium 'High' rating; check the Chrome Releases blog and the Chromium bug entry for CVE-2026-118321 to confirm the component and any exploitation status.","how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome, or run `adb shell dumpsys package com.android.chrome | grep versionName` from a workstation\n- Compare the reported version against `156.0.8078.73`; anything lower is affected","needs_analyst":true,"not_affected_if":["already-on-156.0.8078.73","desktop-only"],"who_is_affected":"Anyone running Google Chrome on Android older than 156.0.8078.73 is exposed, since the flaw is in Chrome's core rendering and input handling. Exposure comes from browsing to a page an attacker controls, so any user who opens untrusted links is in scope. Devices already on 156.0.8078.73 or later can skip this; the sources do not address other Chromium-based browsers.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":3298,"output_tokens":683,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118321':14A,17A '-2026':13A,16A '156.0.8078.73':36B,72C 'allow':73C 'android':3A,18B,34B,69C 'arbitrari':80C 'attack':40B,48B,76C 'browser':19B,45B 'chrome':1A,20B,32B,66C 'chromium':90C 'code':42B,81C 'compon':29B 'core':28B,63C 'craft':8A,53B,87C 'cve':12A,15A 'escap':10A 'execut':79C 'flaw':6A 'googl':31B,65C 'high':93C 'html':54B,88C 'improp':23B,59C 'input':4A,24B,60C 'let':7A,37B 'mobil':21B 'open':58B 'outsid':43B,82C 'page':9A,55B,89C 'potenti':78C 'prior':70C 'remot':39B,75C 'run':41B 'runtim':22B 'sandbox':11A,46B,84C 'secur':91C 'sever':92C 'trigger':50B 'valid':5A,25B,61C 'via':85C 'victim':57B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome on Android older than 156.0.8078.73 is exposed, since the flaw is in Chrome's core rendering and input handling. Exposure comes from browsing to a page an attacker controls, so any user who opens untrusted links is in scope. Devices already on 156.0.8078.73 or later can skip this; the sources do not address other Chromium-based browsers.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118321","severity":null,"published_at":"2026-10-27T23:17:00+00:00","modified_at":"2026-10-27T23:17:00+00:00","first_seen_at":"2026-10-27T23:29:43+00:00","fetched_at":"2026-10-27T23:29:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}