External risk intelligence

Google Chrome for Android Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113169

The vulnerability exists within the browser's client-side processing of web content. While it requires a crafted HTML page, the attack surface is the client browser application on the user's device, not a public-facing service, gateway, or internet-accessible appliance. It is a client-side execution issue, which does not constitute a public-internet-facing attack surface in common deployment patterns.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability in Google Chrome on Android could allow a remote attacker to execute code outside the browser's protected environment by tricking a user into visiting a malicious webpage. The Chromium security team has assessed this as a low-severity issue.

Website code could run with more system access.
User interaction is required for exploitation.
Confirm relevance and exposure to user devices.

Attack Path

How an attacker could exploit the issue

A remote attacker can trick a user into visiting a malicious website. This website contains a specially crafted HTML page designed to trigger a memory corruption vulnerability within the WebAppInstalls component of the Chrome browser on Android. Successful exploitation could allow the attacker to execute arbitrary code, potentially impacting the device beyond the browser's security sandbox.

Entry condition: User visits a malicious site.
Trigger point: Crafted HTML page in WebAppInstalls.
Resulting risk: Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A memory corruption vulnerability in WebAppInstalls on Android could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a specially crafted HTML page.

Arbitrary code execution outside the sandbox.
Visiting a crafted HTML page.
Compromise of user device.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Android and requires user interaction via a crafted HTML page. The primary teams to engage would be those managing enterprise mobility, device management, and potentially the application owners responsible for Chrome deployments. The immediate practical step is to identify all Android devices running Chrome, assess their exposure to the internet or untrusted sites, and confirm which users or business units rely on them for critical functions.

Mobile/Device management teams own the issue.
Verify Chrome version and user exposure.
Plan controlled updates via MDM.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android and its WebAppInstalls component?

Google Chrome for Android is a web browser used for mobile internet browsing. The WebAppInstalls component is a internal module within the browser responsible for managing the installation and integration of Progressive Web Apps. This part of the software handles the logic that allows web pages to behave like native applications on your device.

What does memory corruption mean in the context of CVE-2026-113169?

Memory corruption (CWE-119) occurs when a program inadvertently modifies or accesses memory locations it should not. In this specific CVE, the browser's WebAppInstalls feature fails to safely handle data from a crafted HTML page. Because the program cannot properly manage its own memory, an attacker can overwrite critical data, potentially allowing them to run unauthorized code that escapes the browser's security sandbox.

How is this vulnerability triggered by a malicious website?

The flaw requires a user to navigate to a specifically crafted HTML page designed to exploit the WebAppInstalls component. It is not triggered by simply having the browser installed or running in the background. Normal, non-malicious web browsing does not trigger the vulnerability; the browser must process the specific malicious code structure contained within the crafted page to reach the vulnerable state.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that this risk is very unlikely to affect infrastructure, as the vulnerability exists within the client-side browser application on a user's device rather than a public-facing service or server. Because the attack surface is the browser itself and requires specific user interaction, it does not represent the same exposure profile as an internet-facing gateway or appliance.

How should I respond if I use Google Chrome for Android?

Your first step is to verify the version of Chrome installed on your Android devices to ensure it is updated beyond 156.0.8078.47. If you manage multiple devices, use your mobile device management (MDM) tools to inventory current versions and plan a coordinated update. Prioritize devices used for sensitive tasks and ensure users are aware that navigating to untrusted or suspicious websites is the primary vector for this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.