CVE-2026-113055 Overview
CVE-2026-113055 is a type confusion vulnerability in the FullScreen component of Google Chrome on Android. Versions prior to 156.0.8078.47 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page.
The flaw is classified under CWE-843: Access of Resource Using Incompatible Type. Google rates the Chromium severity as Medium, while NVD assigns a higher CVSS score reflecting the code execution impact. Exploitation requires user interaction, typically visiting an attacker-controlled URL.
Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox on Android devices, providing a foothold for subsequent sandbox escape chains.
Affected Products
- Google Chrome for Android versions prior to 156.0.8078.47
- Google Android devices running vulnerable Chrome builds
- Chromium-based mobile browsers sharing the affected FullScreen code path
Discovery Timeline
- 2026-10-20 - CVE-2026-113055 published to the National Vulnerability Database
- 2026-10-21 - Entry last modified in NVD
Technical Details for CVE-2026-113055
Vulnerability Analysis
The vulnerability resides in Chrome's FullScreen implementation on Android. Type confusion occurs when code accesses an object assuming one type while the underlying memory holds a different type. The mismatch allows an attacker to manipulate pointers, read out-of-bounds memory, or redirect execution flow.
An attacker hosts a crafted HTML page that triggers specific FullScreen state transitions. The resulting type mismatch corrupts internal browser state and enables arbitrary code execution within the renderer process sandbox. Exploitation is constrained to the sandbox boundary unless chained with a separate sandbox escape.
The EPSS probability for near-term exploitation is 0.483%. No public proof-of-concept or exploitation in the wild has been reported at publication.
Root Cause
The root cause is improper type handling [CWE-843] in the FullScreen subsystem. Chrome's renderer treats a JavaScript or DOM object as a type that does not match its actual allocation. This incorrect assumption breaks memory safety invariants that normally protect object property access and method dispatch.
Attack Vector
Attackers deliver the exploit through a malicious or compromised web page. The victim must load the page in a vulnerable Chrome build on Android and interact with the FullScreen flow. No elevated privileges or prior authentication are required. The attack is executed entirely over the network.
See the Chromium Issue Tracker entry for additional technical references.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113055
Indicators of Compromise
- Unexpected Chrome renderer process crashes on Android with FullScreen-related stack frames
- Outbound connections from Chrome to unknown domains immediately following FullScreen events
- Mobile device management (MDM) telemetry showing Chrome versions below 156.0.8078.47
- Child processes or unusual IPC traffic originating from the Chrome sandbox
Detection Strategies
- Inventory installed Chrome versions across managed Android fleets and flag builds below 156.0.8078.47
- Monitor browser crash reports and WebView telemetry for FullScreen API anomalies
- Deploy network inspection to identify HTML payloads that invoke rapid FullScreen state transitions combined with heap-grooming JavaScript
Monitoring Recommendations
- Centralize Android browser version reporting through endpoint and MDM platforms
- Alert on access to newly registered or low-reputation domains from mobile browsers
- Track Chrome Stable Channel announcements to correlate internal patch status with vendor releases
How to Mitigate CVE-2026-113055
Immediate Actions Required
- Update Google Chrome on Android to version 156.0.8078.47 or later through the Google Play Store
- Enforce automatic browser updates on managed Android devices via MDM policy
- Restrict access to untrusted web content on devices that cannot be updated immediately
- Review mobile browsing policy to limit exposure to unknown domains until patching completes
Patch Information
Google addressed CVE-2026-113055 in the Chrome Stable Channel release documented in the Google Chrome Update Announcement. Users on Android should install Chrome 156.0.8078.47 or newer. Enterprise administrators should validate rollout through Play Store managed configurations.
Workarounds
- Disable or avoid FullScreen interactions on untrusted sites until the patch is applied
- Use alternative, patched Chromium-based browsers on Android where available
- Apply network-level content filtering to block known malicious domains serving exploit pages
# Verify Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Patched versions should report 156.0.8078.47 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
