CVE-2026-78937
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Use after free in the Search component in Google Chrome on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a medium severity rating.
Risk Assessment
An attacker could use social engineering to trick the user into visiting a malicious page, potentially leading to code execution outside the sandbox and device compromise.
Recommendation
Update Google Chrome on Android to version 152.0.7977.65 or later to fix this vulnerability.
Original NVD description (English source)
Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)