EUVD-2026-105426
GHSA-3xw2-p82h-rhp2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitMalformed input reaches ANGLE component
-
ExecutionTrigger improper input validation flaw
-
ImpactExecute arbitrary code in renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a macOS user running Google Chrome prior to 156.0.8078.47 to actively visit or load an attacker-controlled crafted HTML page (UI:R) that exercises the ANGLE graphics backend; no authentication or pre-existing privileges are needed (PR:N). Key limiting factors: the vulnerability is confined to macOS builds, code execution is contained within the renderer sandbox (Scope:Unchanged), so a separate sandbox-escape is required for full host compromise, and user interaction (navigating to the malicious page) is mandatory, which rules out fully drive-by server-side triggering without social engineering or malvertising. |
| Impact | This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes remote, low-complexity, unauthenticated exploitation requiring user interaction - consistent with a browser flaw triggered by visiting a crafted HTML page. Google rates the Chromium severity 'High' and the 8.8 base score reflects full C/I/A impact. However, the description explicitly states code execution occurs 'inside the sandbox' (Scope:Unchanged), meaning this is a renderer-level compromise that would need a separate sandbox-escape to achieve full host takeover - a material limiting factor the raw 8.8 score does not convey. On exploitation signals: no EPSS score was provided, there is no CISA KEV listing, and no public exploit was identified in the input, so this is not confirmed to be actively exploited. The combination 'High severity + patch already shipped + no exploitation evidence' places this in the routine-but-prompt-patching category rather than emergency. Note the minor data artifact 'on on Mac' and Mac-only scoping in the description versus the network CVSS vector - the AV:N is correct (delivery is a web page), but the affected platform is specifically macOS. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted content that reaches Chrome's ANGLE graphics layer; when a macOS user with a vulnerable Chrome build visits the page, the improper input validation is triggered. Successful exploitation yields arbitrary code execution within the renderer sandbox, which the attacker would typically chain with a separate sandbox-escape to compromise the host. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper input validation in the ANGLE graphics translation layer shipped with Google Chrome on macOS before 156.0.8078.47 permits a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the macOS user must actively visit or load attacker-controlled content - and the resulting code execution remains contained within the sandbox (Scope:Unchanged), meaning a separate sandbox escape is required for full host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build (156.0.8078.47); Chromium rated the issue High severity and the CVSS 3.1 base score is 8.8.
RemediationAI
Upgrade Google Chrome on macOS to version 156.0.8078.47 or later, using the Stable Channel release documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html - vendor-released patch: 156.0.8078.47. Verify the installed build via chrome://version and confirm auto-update is enabled (Chrome menu > About Google Chrome) so that managed fleets pick up the fix; enterprise administrators can enforce the minimum version through their update policies. Because exploitation requires a user to load a crafted HTML page, interim compensating controls carry trade-offs: enforcing Safe Browsing enhanced protection and DNS/web filtering reduces exposure to known malicious hosts but is bypassable by novel or compromised sites; disabling GPU hardware acceleration (chrome://settings/system, or the --disable-gpu / --disable-gpu-compositing switches via policy) removes the ANGLE code path from normal browsing at a significant performance cost and is not guaranteed to eliminate every reachable ANGLE entry point; and restricting high-risk browsing to isolated environments (remote browser isolation or a separate low-privilege macOS account) limits the value of in-sandbox code execution but adds operational overhead and latency. Keep the renderer sandbox and macOS SIP enabled so any in-sandbox code execution remains contained pending a sandbox-escape chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the cross-platform abstraction layer Chromium uses to translate OpenGL ES API calls into the native graphics APIs of the host platform - on macOS this is typically Metal, with OpenGL and Vulkan backends also supported. Because ANGLE parses shader source, program binaries, and API parameter structures supplied by web content, malformed or adversarial input reaching the translator can corrupt memory or bypass validation logic. The assigned weakness class, CWE-20 (Improper Input Validation), indicates that ANGLE failed to sufficiently validate or sanitize input before acting on it, which the Chrome team's advisory links to potential arbitrary code execution within the sandboxed renderer/GPU process. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-reachable, low-complexity attack with no privileges required but mandatory user interaction, high confidentiality, integrity, and availability impact on the vulnerable component while scope remains unchanged. Affected CPE-class targets are Google Chrome builds for macOS (platform-specific), prior to 156.0.8078.47; the Chromium issue tracker entry 563788518 is restricted per Google's standard practice of withholding exploit details until most users have patched.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Delivered via a web page so AV:N/AC:L/PR:N with UI:R for the required page visit; code stays in the sandbox so S:U, with full renderer C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS prior to 156.0.8078.47 contains a high-severity input validation flaw in the ANGLE graphics layer that can allow code execution within the renderer sandbox when a user visits a crafted web page. Although no public exploit identified at time of analysis and the sandbox limits impact, the broad macOS Chrome footprint warrants prioritized remediation. Leadership should ensure macOS Chrome users are updated promptly to avoid unnecessary exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB