Loading vulnerability…
Potential sandbox-escaping code execution in Google Chrome for Android UI
CVE-2026-118309 is an improper input validation vulnerability in the user interface of Google Chrome on Android before version 156.0.8078.73. A remote attacker could use a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Chromium classifies the vulnerability as High severity. The specific vulnerable function and validation failure have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow attacker-controlled code to execute outside Chrome's sandbox, potentially compromising data confidentiality, integrity, and availability within the permissions of the affected execution context. Execution outside the sandbox does not establish Android root or system-level access.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until the update is applied, reduce exposure to untrusted web pages through managed URL filtering and restrictions on unapproved browsing. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade Google Chrome on Android to version 156.0.8078.73 or a later supported release, then restart the browser to ensure the fixed version is running.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.