EUVD-2026-105419
GHSA-h6qr-rpmm-6rm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers ANGLE memory corruption
-
ExecutionAttacker reads out-of-bounds memory in sandbox
-
ImpactLeak sensitive renderer memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome on Windows prior to 156.0.8078.47 to load attacker-controlled content - specifically a crafted HTML page that exercises the ANGLE graphics backend (Chrome's OpenGL ES-to-Direct3D translation layer). The key limiting factor is mandatory user interaction (UI:R): the user must navigate to or render the malicious page, so there is no zero-click vector. Impact is further bounded because the memory read is confined within the Chrome sandbox, limiting it to a confidentiality leak rather than code execution or host compromise; no special non-default configuration is otherwise required since ANGLE is the default rendering path on Windows. |
| Impact | This is a moderate-severity information disclosure flaw, not a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (visiting a crafted HTML page) and yields only confidentiality impact (C:H) with no integrity or availability loss. Critically, the memory read occurs INSIDE the Chrome sandbox ('read memory inside the sandbox'), so this is a memory-disclosure primitive constrained by the sandbox boundary rather than a full renderer-to-host escape. Exploitation signals are weak-to-moderate: EPSS is 0.22% (12th percentile), indicating low predicted exploitation probability, and there is no public exploit identified at time of analysis and no CISA KEV listing. No SSVC decision data was supplied. Signals are consistent - low EPSS, no KEV, no POC, and a UI-required confidentiality-only vector all point to a real but non-urgent issue typically weaponized (if at all) as one link in a multi-bug chain rather than as a standalone high-value target. Chromium rates the severity 'High' internally, which reflects potential chainability more than standalone impact. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted content that triggers the ANGLE memory-corruption bug when rendered; a victim running an unpatched Chrome on Windows visits the page and the attacker reads sensitive memory contents within the renderer sandbox. No public exploit code is known, and because only confidentiality within the sandbox is affected, realistic use is as an information-leak primitive combined with a separate sandbox-escape bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds memory read in Google Chrome's ANGLE graphics translation layer on Windows (versions prior to 156.0.8078.47) lets a remote attacker leak memory contents from inside the renderer sandbox by getting a victim to render a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), and because the disclosure is contained within the Chrome sandbox it yields confidentiality impact only - no code execution, no integrity or availability effect, and no host escape. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not in CISA KEV; Google rates it High severity and has shipped a fixed build, so this is a moderate-priority patch-and-move-on item rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Windows to 156.0.8078.47 or later - the fix is available from vendor per the October stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and standard auto-update will pull it automatically; verify via chrome://version and force the update through the Google Update / Omaha enterprise policies if the fleet is pinned. Organizations running Chromium derivatives such as Microsoft Edge should confirm their vendor has shipped an equivalent rebuild before considering the exposure closed, since they share the ANGLE code path. If the update cannot be deployed immediately, the most direct compensating control is to disable hardware acceleration in Chrome (Settings > System > 'Use graphics acceleration when available', or the --disable-gpu launch flag), which removes the ANGLE/Direct3D rendering path from reach at the cost of degraded WebGL performance, slower page rendering, and higher CPU/battery consumption on graphics-heavy sites; note that this also breaks or degrades WebGL-dependent applications. Restricting users to trusted sites or filtering untrusted HTML content reduces the chance of a victim loading a crafted page but is only a partial measure given mandatory user interaction is the sole precondition, and Site Isolation offers no meaningful additional protection here because the leak is already confined to the sandboxed process. Prioritize by exposure: given EPSS of 0.22% and no public exploit or KEV listing, this can follow the normal Chrome release-cadence patch cycle rather than an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the shader-translation layer Chrome uses on Windows to map WebGL and OpenGL ES calls onto Direct3D, and it is the default rendering path whenever GPU acceleration is active, meaning no non-default configuration is needed to reach the vulnerable code. The root cause maps to CWE-119 (improper restriction of operations within the bounds of a memory buffer): a memory-corruption condition during ANGLE's handling of attacker-influenced graphics data results in a read that reaches outside the intended buffer bounds. What makes this notable is the sandbox containment - the out-of-bounds read is confined to the compromised renderer/GPU process, so under the assessed vector the attacker gains high confidentiality impact (C:H) but zero integrity or availability impact (I:N/A:N) and no scope change (S:U). In practice that means leaked memory from the sandboxed process could expose heap contents, pointers, or transiting data, which is valuable as a reconnaissance or ASLR-defeat primitive but does not by itself constitute remote code execution. The Microsoft tag attached to this record is consistent with the fact that Chromium-derived browsers such as Microsoft Edge share the ANGLE component and typically inherit the defect until rebuilt against the patched Chromium milestone.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote crafted page with no auth (AV:N/PR:N) but requires the victim to load it (UI:R); only a sandbox-internal memory read, so C:H and I/A:N with scope unchanged.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB