Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118309updated 29 Oct 2026, 16:04 UTC

Google Chrome on Android can be exploited via a crafted web page

A specially built web page could trick Chrome on Android into running an attacker's code outside its normal safety walls. Updating Chrome closes this gap.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesChrome 156.0.8078.73 or later (Android) · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pagePage contains crafted HTML input
  2. 2User opens pageChrome on Android loads the page
  3. 3UI input not validatedImproper input validation in UI
  4. 4Code runs outside sandboxArbitrary code execution possible
  5. ResultAttacker runs code beyond browser sandbox

What happened

Improper input validation in the UI component of Google Chrome for Android before 156.0.8078.73 lets a remote attacker execute arbitrary code outside the sandbox via a crafted HTML page.

Why it is dangerous: Anyone browsing with an unpatched Chrome on Android could be targeted just by visiting a malicious page, potentially giving an attacker control beyond the browser's sandbox.

Are you affected?

You are affected if you use Google Chrome on Android with a version earlier than 156.0.8078.73.

Google Chrome on Android prior to 156.0.8078.73

What to do

  1. Update Chrome on Android to version 156.0.8078.73 or later via the Google Play Store
  2. Check the version under Chrome Settings > About Chrome to confirm the update applied
  3. Restart Chrome after updating so the fix takes effect

Timeline

  1. 27 Oct 2026, 23:16 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:45 UTC
    Reported by Google Chrome · Google Chrome
  3. 28 Oct 2026, 20:32 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 16:04 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118309
CVSS
9.6 / 10
Disclosed
27 Oct 2026, 23:16 UTC
On Zero Radar
28 Oct 2026, 20:32 UTC (21 h after disclosure)
Last change
29 Oct 2026, 16:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome on Android can be exploited via a crafted web page · Zero Radar