External risk intelligence

Google Chrome for Android Prompts Memory Corruption Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-113171

This vulnerability is a client-side issue within the Google Chrome browser on Android. It requires a user to navigate to a specifically crafted HTML page to trigger the vulnerability, rather than being an internet-facing service, gateway, or infrastructure component that is exposed for remote connection.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory corruption vulnerability in Google Chrome on Android could allow a remote attacker to execute code outside the browser's protected environment by tricking a user into visiting a malicious web page. This type of issue has the potential to impact user data and system integrity if exploited.

A Chrome flaw can bypass security protections.
Users visiting bad sites could be at risk.
Confirm relevance to understand potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit this vulnerability by enticing a user to visit a malicious web page. This page would contain specially crafted HTML designed to trigger a memory corruption flaw within the Chrome browser on Android. If successful, this could allow the attacker to execute code outside the browser's secure environment.

Requires user interaction via a web page.
Memory corruption in Prompts feature.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A memory corruption vulnerability in prompts within Google Chrome on Android could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a specially crafted HTML page.

Browser code execution.
Via crafted HTML page.
Potential for unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Prompts component in Google Chrome on Android is affected by a memory corruption vulnerability. Teams responsible for managing end-user devices and the browser environment, such as endpoint management or security operations, should take the lead in assessing and remediating this risk. The initial focus should be on identifying all Android devices running vulnerable versions of Chrome, determining user exposure through web browsing habits, and planning for prompt updates or mitigations.

Identify accountable device owners.
Verify browser version and user exposure.
Coordinate browser update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android and how does it function?

Google Chrome for Android is a web browser built on the Chromium engine. It provides the core environment for rendering web pages, executing JavaScript, and managing user interface interactions like prompts. It relies on a sandbox, which is a security mechanism designed to isolate browser processes from the underlying operating system to ensure that malicious websites cannot easily compromise the device or access private user data.

What does memory corruption mean in the context of CVE-2026-113171?

Memory corruption, classified as CWE-119, occurs when a program inadvertently modifies or accesses memory locations it should not. In this specific vulnerability, the Prompts feature in Chrome fails to handle data correctly. Because the browser manages complex tasks, this flaw allows a malicious site to overwrite critical memory, potentially forcing the browser to execute unintended instructions and escape the security sandbox.

How is this Chrome memory corruption vulnerability triggered?

An attacker triggers this bug by enticing a user to visit a specially crafted HTML page. The vulnerability resides specifically within the browser's Prompts component, so it only executes when that code path is engaged during page rendering. Simply having the browser installed or running in the background is not enough to trigger the issue; the user must actively navigate to the malicious site.

Is this vulnerability considered internet-facing?

According to Halo Surface Signal, this is a client-side issue, not an internet-facing service or infrastructure component. It does not provide an open port for remote connections that attackers can scan and exploit at will. Because it requires a user to navigate to a specific malicious page, the risk depends on user browsing behavior rather than the exposure of a server or network gateway.

What should I do if I use Chrome on Android?

The most effective step is to ensure your browser is updated to version 156.0.8078.47 or later. Since this flaw is patched by updating the application, verify your current version within the Chrome settings or your device's app store. If you manage multiple devices, prioritize deploying this update across your fleet to close the security gap created by the memory corruption flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.