Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-113233: Chrome for Android may let attackers run code

CVE-2026-113233 · published 15 days ago

Summary

Versions of Google Chrome on Android before 156.0.8078.47 can be tricked by a specially crafted web page to run code beyond the browser’s safety barriers. If an attacker already gains limited control inside the browser, this flaw could let them execute any program on the device. Update Chrome to the latest version to eliminate the risk.

What to do

Update debian chromium to version 156.0.8078.47-1~deb12u1.
Update debian chromium to version 156.0.8078.47-1~deb13u1.
Update debian chromium to version 156.0.8078.47-1.
Update google chrome to version 156.0.8078.47 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	google	chrome	< 156.0.8078.47
Debian:12	debian	chromium	< 156.0.8078.47-1~deb12u1 Fix: upgrade to 156.0.8078.47-1~deb12u1
Debian:13	debian	chromium	< 156.0.8078.47-1~deb13u1 Fix: upgrade to 156.0.8078.47-1~deb13u1
Debian:14	debian	chromium	< 156.0.8078.47-1 Fix: upgrade to 156.0.8078.47-1

Original advisory text

Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the san...

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition

Timeline

Published20 Oct 2026

Updated4 Nov 2026

First seen20 Oct 2026

Sources

CVE-2026-113233 · NVD

CVE-2026-113233 · MITRE

DEBIAN-CVE-2026-113233 · OSV

Track software like this

Free during beta