CVE-2026-113173: Improper input validation in Google Chrome

This vulnerability in Google Chrome on Android is caused by improper input validation in the UI component. An attacker can craft a malicious HTML page that, when viewed by the user, may lead to arbitrary code execution inside the sandboxed environment of the browser. The issue affects versions prior to 156.0.8078.47. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges required, but user interaction is necessary. The impact includes high confidentiality, integrity, and availability consequences.

Successful exploitation allows remote code execution within the sandbox, potentially compromising the confidentiality, integrity, and availability of the affected device. However, the attack requires user interaction (e.g., visiting a malicious webpage). There are no known exploits in the wild at the time of publication.

A fix is available in Google Chrome version 156.0.8078.47. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html for details.