EUVD-2026-105675
GHSA-2jxp-9mq9-f7qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
ExploitDeliver crafted HTML/graphics content
-
ExecutionTrigger leak in ANGLE component
-
ImpactExfiltrate leaked sensitive memory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to run Google Chrome on Windows at a version prior to 156.0.8078.47 and to actively load an attacker-controlled HTML page that exercises the vulnerable ANGLE (graphics abstraction layer) rendering path - the CVSS UI:R confirms mandatory user interaction (navigating to or being redirected to the page). No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since ANGLE is the standard graphics backend on Windows. The primary limiting factor is the user-interaction requirement: there is no drive-by exposure without the user loading attacker content, and the impact is limited to information disclosure (no integrity or availability effect). |
| Impact | This is a medium-severity information disclosure flaw (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) in the ANGLE graphics component of Google Chrome on Windows. The CVSS vector indicates remote, low-complexity, unauthenticated exploitation but gates it behind user interaction (UI:R) - the victim must load an attacker-controlled HTML page. Impact is confined to confidentiality (C:H, with I:N/A:N), consistent with a memory/information leak rather than code execution. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' Google rates the Chromium severity as Medium, which aligns with the leak-only impact. Net assessment: patch in the normal browser-update cadence rather than as an emergency; the required user interaction and absence of exploitation signals make this a lower real-world priority than the raw network-vector metrics might suggest, though browser-delivered leaks can seed follow-on attacks (e.g., ASLR/pointer disclosure assisting a separate RCE chain). |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted content that triggers the ANGLE information leak and lures a Chrome-on-Windows user to visit it (UI:R). When the page renders, the flaw leaks sensitive in-process memory or other confidential data back to the attacker. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Information disclosure in ANGLE, the graphics translation layer bundled with Google Chrome on Windows, affects releases prior to 156.0.8078.47. A remote attacker who convinces a user to load a crafted HTML page can exercise the vulnerable rendering path and leak sensitive process memory or cross-origin data; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) confirms confidentiality-only impact that requires user interaction, with no privileges or authentication needed and default Chrome configurations exposed because ANGLE is the standard graphics backend on Windows. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the issue Chromium security severity Medium.
RemediationAI
Vendor-released patch: upgrade Google Chrome on Windows to 156.0.8078.47 or later, distributed through the Chrome stable channel release documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; enterprise fleets should push this build via their update mechanism and verify version compliance on endpoints, since the flaw is present in the default ANGLE configuration and cannot be avoided by normal browsing. Where immediate updating is not possible, the practical compensating controls are to disable hardware acceleration and WebGL (chrome://settings/system and chrome://flags or the HardwareAccelerationModeEnabled / WebGL policies), which removes the reachable ANGLE path at the cost of degraded rendering performance and broken graphics-heavy internal applications; alternatively, restrict browsing to allowlisted sites through URL filtering to reduce exposure to untrusted HTML, accepting that this does not eliminate risk for users who must reach arbitrary web content. Restarting Chrome after any flag or policy change is required for it to take effect, and no vendor workaround beyond updating is documented in the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the open-source abstraction layer Chrome uses on Windows to translate OpenGL ES and WebGL API calls into Direct3D, sitting between renderer content and the GPU process. This entry is classified CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the root cause is improper handling of data during graphics resource translation or teardown - for example, buffers, textures, or shader-related structures that are returned to or observable by a web page beyond their intended scope. Because the flaw lives in the shared graphics component rather than in a single site, any web content rendered through WebGL/ANGLE can reach the vulnerable code path; the UI:R component of the vector reflects that the victim must actually navigate to attacker-controlled HTML, while PR:N and the absence of I/A impact indicate no privilege gain and no memory corruption beyond disclosure. The references point to the Chrome stable channel release and the restricted Chromium issue tracker entry, which typically stays access-limited until most users have updated.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted-page delivery (AV:N/AC:L/PR:N) requires the victim to load the page (UI:R); impact is confidentiality-only (C:H, I:N, A:N) with no scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB