External risk intelligence

Google Chrome for Android Search Vulnerability Allows Code Execution via HTML.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-106241

The vulnerability exists within the Chrome browser on Android and requires a user to be socially engineered into visiting a crafted HTML page. It is a client-side interaction rather than a service, appliance, or infrastructure component that is typically exposed to the public internet for reachability.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in Google Chrome on Android could allow attackers to execute code outside the browser's protected environment through a malicious webpage and social engineering. While the technical details suggest a targeted approach, understanding the potential for code execution warrants attention to confirm relevance within our environment.

Attackers could execute code outside browser sandbox.
Confirms potential for code execution; verify exposure.
Assess impact if user interaction is confirmed.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. If the user clicks a link or visits a specially crafted HTML page, the browser's search feature could be tricked into running code outside of its secure sandbox, potentially leading to arbitrary code execution.

No specific access needed.
User visits a crafted HTML page.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could trick users into visiting a malicious HTML page, potentially allowing them to execute arbitrary code outside the browser's security sandbox. This could impact user data and device integrity when interacting with a vulnerable browser on Android.

Arbitrary code execution outside sandbox.
Via crafted HTML page with social engineering.
Compromise of user data and device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in Chrome on Android requires a user to interact with a malicious HTML page, suggesting that mobile device owners and application support teams should investigate exposure. The first practical step is to identify all Android devices running potentially vulnerable Chrome versions, determine if they are critical assets, and confirm their user or owner before planning any remediation.

Mobile device owners and app support teams.
Confirm Chrome on Android exposure and user criticality.
Coordinate user communication and targeted updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome on Android and how is it used?

Google Chrome on Android is a widely used mobile web browser that allows users to navigate the internet, manage bookmarks, and utilize integrated search capabilities. It functions as a primary interface for accessing online content, and it employs a security sandbox—a restricted environment—to isolate web processes from the underlying mobile operating system and protect user data.

What does CWE-863 mean for CVE-2026-106241?

CWE-863 represents a class of vulnerability known as Incorrect Authorization. In the context of this CVE, it means the browser's search feature fails to properly verify if an operation is permitted. Because of this flaw, a specially crafted webpage can bypass security checks, allowing unauthorized code to execute outside the browser's protective sandbox.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by using social engineering to lure a user into visiting a malicious HTML page. This bug is not triggered by simply browsing legitimate sites or by background service activity; it specifically requires that the user interacts with the crafted content, which then exploits the authorization flaw in the browser's search functionality.

Is my device at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to affect typical infrastructure, as it exists within a client-side application rather than an internet-exposed server. The risk is primarily tied to individual user behavior and whether mobile users are interacting with untrusted or malicious web content on their Android devices.

What should I do if I use Chrome on Android?

The primary response is to ensure your browser is updated to the latest available version provided by Google. Additionally, verify which Android devices in your environment are running affected versions. Focus your efforts on confirming these assets and communicating with users to maintain awareness of suspicious links or unverified webpages.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.