EUVD-2026-116394
GHSA-6486-r83f-qqqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger out-of-bounds write in ANGLE
-
ExploitCorrupt memory to gain control of execution
-
ExecutionEscape the Chrome renderer sandbox
-
ImpactExecute arbitrary code on Windows host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled web content in Chrome - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (visiting/rendering a malicious page) is mandatory; there is no server-side or click-free trigger described. The affected component is ANGLE, Chrome's default graphics abstraction layer, so no special feature toggle or non-default configuration is needed beyond normal browsing. Limiting factors that reduce realistic risk: the bug is scoped to Windows only (per the description), it affects versions prior to 157.0.8103.38, and it depends on luring a user to malicious content rather than remote unauthenticated server exploitation. Per CVSS PR:N the attacker needs no authentication to the target. |
| Impact | Signals are mostly aligned toward high priority but with one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes a network-reachable, low-complexity, unauthenticated flaw whose scope change (S:C) reflects the stated sandbox escape, and the SSVC Technical Impact of 'total' agrees with full C/I/A compromise of the Windows host. The vuln.today Decision label is act_now, consistent with a total-impact memory-corruption bug in a ubiquitous browser. Countervailing signals: SSVC Exploitation is 'none' and there is no CISA KEV listing, so there is no evidence of current real-world exploitation, and SSVC Automatable is 'no' - which fits UI:R, since the attack needs a victim to open a crafted page and therefore cannot be fully automated/wormed. No EPSS score was provided in the input, so the statistical exploitation-probability signal is MISSING and cannot be weighed. Net: this is a genuine high-priority patch item driven by total technical impact plus Chrome's enormous footprint and the vendor's act_now call, not merely a high-CVSS-but-low-real-risk issue - but it currently reads as a not-yet-exploited bug (no KEV, SSVC exploitation none) rather than an actively-attacked one. The UI:R requirement is the main factor tempering raw urgency. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page (e.g., via phishing, a watering-hole site, or malvertising) that drives Chrome's ANGLE graphics layer into an out-of-bounds write. When a Windows user running a version prior to 157.0.8103.38 visits the page, the memory corruption is triggered and can be leveraged to execute arbitrary code outside the renderer sandbox, on the host. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Chrome on Windows prior to 157.0.8103.38 contains an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, which a remote attacker can trigger by getting a victim to render a crafted HTML page, potentially achieving code execution outside the browser sandbox. The issue is rated high severity by Chromium, carries a CVSS score of 9.6 (scope-changed, high confidentiality, integrity, and availability impact), and affects Windows deployments only. No public exploit code and no active exploitation have been identified at time of analysis, though the prioritization signal is act_now and Chrome's stable-channel advisory provides the fix; the mandatory user interaction and browser-context prerequisites temper real-world risk somewhat.
RemediationAI
Vendor-released patch: upgrade Google Chrome on Windows to 157.0.8103.38 or later via the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html; confirm the deployed build number after rollout, since the bug affects every earlier version on Windows. Because exploitation requires the victim to render a crafted HTML page, exposure is reduced by ensuring the update is applied before users resume general browsing and by verifying version compliance across managed Windows fleets. The supplied sources do not list separate workarounds, feature toggles, or configuration mitigations for the ANGLE flaw, and do not state that disabling a specific feature avoids the issue; the available fix data consists of the updated browser build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map OpenGL ES calls onto platform graphics APIs such as Direct3D on Windows, and it sits inside the GPU/renderer process boundary that Chrome's sandbox constrains. The flaw is a CWE-787 out-of-bounds write: data is written past the end of an intended buffer within ANGLE's handling of graphics operations reached through ordinary web content, corrupting adjacent memory. Because the CVSS vector is scope-changed (S:C) with PR:N and UI:R, exploitation yields impact beyond the vulnerable component - the description states code execution outside the sandbox - while still requiring the victim to load attacker-controlled web content; authentication requirements for the attacker are none per the vector. The affected CPE is the generic google:chrome product entry with versions below 157.0.8103.38, and the description scopes the impact to Windows. The precise trigger within ANGLE's rendering path is not described in the available sources.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but mandatory victim visit (UI:R); sandbox escape to the host justifies S:C with full C:H/I:H/A:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome on Windows contains a critical memory-corruption flaw in its graphics rendering engine, ANGLE, that could allow a remote attacker to execute code outside the browser sandbox if a user visits a specially crafted webpage. This affects all Windows endpoints running Chrome versions prior to 157.0.8103.38, potentially enabling unauthorized access to sensitive data, system compromise, and service disruption. While no active exploitation has been observed, the severity and ease of triggering via user interaction warrant immediate leadership attention to protect the organization's Windows user base.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB