CVE-2026-113233: Out of bounds read in Google Chrome

This vulnerability involves an out of bounds read in the Core of Google Chrome on Android versions before 156.0.8078.47. Exploitation requires a remote attacker to deliver a specially crafted HTML page that triggers the flaw, potentially leading to arbitrary code execution inside the sandbox environment. The issue affects the Chrome browser on Android and was publicly disclosed with a medium severity rating by the Chromium security team. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation could allow remote code execution within the sandbox on affected Android devices running vulnerable versions of Google Chrome. This could lead to unauthorized actions or compromise of the browser environment, although the sandbox limits broader system impact. No known exploits in the wild have been reported at this time.

A fix is available in Google Chrome version 156.0.8078.47 and later. Users and administrators should update affected Chrome installations on Android to this version or newer to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for details: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html