EUVD-2026-89373
GHSA-pqf3-x5qw-v98w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled page
-
DeliveryMalicious HTML/graphics reaches ANGLE
-
ExploitTrigger heap buffer overflow
-
ExecutionExecute code outside sandbox
-
ImpactFull compromise of host process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using a vulnerable Chrome build (prior to 154.0.8037.92) to visit or render an attacker-controlled crafted HTML page that drives Chrome's ANGLE graphics layer (UI:R - user interaction is the primary limiting factor). No authentication or privileges are needed (PR:N), and no special non-default configuration is indicated since ANGLE is core to Chrome's rendering. Per the description the affected platform is Android, though this is not fully corroborated by the CPE. The main mitigants are the required user interaction and that SSVC reports no observed exploitation and non-automatable exploitation. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated heap buffer overflow (CWE-122) in ANGLE - Chrome's graphics translation layer - that Google rates Chromium-Critical, with the scope change (S:C) reflecting arbitrary code execution OUTSIDE the renderer sandbox. Only user interaction (visiting a crafted page) is required. However, the exploitation signals temper the raw score: SSVC reports Exploitation=none (no observed exploitation), Automatable=no, though Technical Impact=total, which is consistent with a full sandbox-escape RCE. There is no CISA KEV listing and no public POC identified, so this is a patch-now-but-not-yet-exploited situation rather than an active-attack emergency. One data inconsistency to flag: the description explicitly scopes this to 'Google Chrome on Android,' but the only CPE provided is the generic cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (no android platform), and the referenced Chrome release note is titled 'stable-channel-update-for-desktop' - verify the exact affected platform(s) with the vendor, as ANGLE flaws frequently span multiple platforms. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted content (e.g. WebGL/graphics primitives) that triggers a heap buffer overflow in Chrome's ANGLE component when rendered. A victim running a vulnerable Chrome (<154.0.8037.92) simply visits the page, and the overflow is leveraged to execute arbitrary code outside the browser sandbox. No public exploit code has been identified at time of analysis, and SSVC indicates no known exploitation, so this remains a drive-by RCE risk rather than a confirmed in-the-wild attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.
RemediationAI
Upgrade Google Chrome on Android to version 154.0.8037.92 or later via the Google Play Store, or, if the deployment is managed, push the vendor-released stable build (vendor-released patch: 154.0.8037.92) to all managed devices; the release notes and issue tracker entries are at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html and https://issues.chromium.org/issues/551673541. Until the update is applied, the most direct compensating control on managed Android devices is to disable the WebGL rendering path that exercises ANGLE by setting the DefaultWebGL1Enabled and DefaultWebGL2Enabled enterprise policies to 2 (disabled) - the trade-off is that WebGL-based content, including 3D visualization, web games, and some mapping/canvas applications, will fail or fall back to slower software rendering, and policy coverage on Android is more limited than on desktop. Restricting browsing to trusted origins and reducing exposure to untrusted or user-submitted HTML content lowers the likelihood of triggering the required crafted page, but it does not remove the underlying ANGLE flaw; there are no user-facing toggles that isolate ANGLE specifically, so patching remains the only complete fix. Given the Critical severity rating and high CVSS score, treat deployment as time-sensitive even though no exploitation has been observed to date.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the graphics abstraction layer bundled with Chromium that translates OpenGL ES/EGL calls - and backs WebGL and WebGPU rendering - onto native backends such as Vulkan or GLES on Android. The assigned weakness, CWE-122 (heap-based buffer overflow), points to insufficient bounds validation on an ANGLE heap buffer, allowing attacker-influenced graphics or shader data to overwrite memory past the allocation. Because ANGLE is a core rendering component, the flaw sits on a path an attacker can drive purely through web content, with no privileges required (PR:N) and no non-default configuration indicated; the required user interaction (UI:R) is the principal precondition. The scope-changed metric (S:C) and the vendor's phrasing that code execution may occur "outside the sandbox" indicate the memory corruption can potentially be leveraged beyond the renderer/GPU process boundary, which is why the impact is rated high on confidentiality, integrity, and availability. The supplied CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, is platform-agnostic and carries no version constraints, so it should not be read as contradicting the advisory's Android-specific scope; ENISA's EUVD entry (EUVD-2026-89373) captures the affected range as Chrome versions below 154.0.8037.92.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a page visit (UI:R), no auth (PR:N); heap overflow yields code execution outside the sandbox (S:C) with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Articles & Coverage 1
Executive ViewAI
Google Chrome on Android, one of the most widely deployed applications across the organization's mobile estate, carries a critical memory-corruption flaw in its ANGLE graphics layer that could allow an attacker to run code beyond the browser's sandbox when a user simply views a crafted web page. Because compromise depends only on a user visiting attacker-controlled content on an unpatched device, the exposure spans every Android phone and tablet in the fleet, including BYOD hardware outside standard management. Leadership should treat this as a time-bound mobile patching and exposure-management issue rather than a theoretical one, and drive remediation through the mobile fleet before the flaw becomes a favored target.
Apply vendor patch. Chrome 154.0.8037.92 is available; interim measures include restricting mobile browsing to trusted sites, blocking known malicious domains through mobile threat defense or DNS filtering, and enforcing managed Play update policies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB