EUVD-2026-105448
GHSA-v74r-g32f-8pf5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled web page
-
DeliveryServe crafted HTML to ANGLE graphics layer
-
ExploitTrigger memory corruption in ANGLE
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAchieve code execution (sandbox-constrained)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Chrome on Windows prior to 156.0.8078.47 to load a crafted HTML page that exercises the ANGLE graphics backend (UI:R - user interaction via navigation is mandatory, limiting mass automated exploitation). No authentication or special privileges are needed (PR:N), and default Chrome configurations are affected since ANGLE is Chrome's standard graphics translation layer. The key limiting factor is that successful code execution is confined to the renderer sandbox (S:U); meaningful host compromise requires chaining an additional sandbox-escape vulnerability, which this CVE alone does not provide. |
| Impact | This is a genuinely high-priority browser vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction (visiting a crafted HTML page), with high confidentiality, integrity, and availability impact. The description explicitly scopes code execution to 'inside the sandbox,' which is consistent with the S:U (scope unchanged) metric - meaning this is renderer-level compromise and would require chaining with a separate sandbox-escape to achieve full host compromise. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified from the data; however, ANGLE/graphics memory-corruption bugs in Chromium are historically high-value targets frequently weaponized. The signals are internally consistent (no CVSS-vs-description conflict), but the absence of EPSS/KEV/POC data means real-world exploitation status is UNKNOWN rather than low. Treat as a standard-urgency Chrome patch-now item given ubiquity and reliable patch availability. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious HTML/graphics content that drives Chrome's ANGLE graphics layer. A victim using an unpatched Chrome on Windows visits the page, triggering memory corruption and arbitrary code execution within the renderer sandbox. No public exploit was identified in the provided data, and full system impact would additionally require a sandbox-escape primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's ANGLE graphics layer on Windows before 156.0.8078.47 enables remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication, and because the impact is sandbox-limited (S:U), an attacker would need a separate sandbox-escape flaw to compromise the host. Vendor patches are available in Chrome 156.0.8078.47, and no public exploit was identified at time of analysis.
RemediationAI
Upgrade Google Chrome on Windows to version 156.0.8078.47 or later and restart the browser so the new binary is loaded; confirm the version via chrome://version. Google's stable-channel advisory is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, with the underlying issue tracked at https://issues.chromium.org/issues/563355257. If immediate patching is not possible, reduce exposure by disabling hardware acceleration (chrome://settings/system, 'Use graphics acceleration when available' off) and, in managed environments, setting the Chrome policies HardwareAccelerationModeEnabled=false and Disable3DAPIs=true to limit ANGLE/WebGL reachability; these controls can break GPU-accelerated rendering and 3D web applications and do not replace the patch. Enforce browser updates through enterprise update policy and restrict use of unpatched Chrome instances for untrusted web content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics translation layer, mapping OpenGL ES and WebGL calls to platform APIs such as Direct3D on Windows; it is enabled by default in Chrome. CWE-119 covers improper restriction of operations within the bounds of a memory buffer, so a crafted HTML page can trigger out-of-bounds memory access and corrupt memory in the renderer process, potentially leading to arbitrary code execution within Chrome's sandbox. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms remote reachability, no privileges required, mandatory user interaction, and scope unchanged, meaning this CVE alone does not escape the sandbox.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page delivery (AV:N, AC:L, PR:N) requires the victim to visit the page (UI:R); renderer-sandbox code execution yields C/I/A:H with scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows endpoints is exposed to a memory-corruption flaw in the ANGLE graphics layer, allowing a crafted web page to run attacker code inside the browser's renderer sandbox. Every employee who browses the web with an unpatched Chrome build is a potential entry point, though a full host compromise would require chaining a second, separate sandbox-escape vulnerability. Leadership should care because the browser is the organization's largest externally reachable attack surface and a low-effort, centrally managed update closes this exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB