EUVD-2026-105461
GHSA-gq5m-2j6x-mr8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious ANGLE/WebGL content
-
ExploitLure victim to visit page in Chrome on Windows
-
ExecutionTrigger out-of-bounds read in ANGLE
-
ImpactLeak adjacent in-sandbox memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled HTML page in Google Chrome on Windows at a version prior to 156.0.8078.47, with the page delivering crafted content that exercises the ANGLE graphics backend (WebGL/GPU rendering path). Mandatory limiting factors: user interaction is required (UI:R) - the attack cannot occur without the user navigating to the malicious page - and the affected platform is restricted to Windows per the description. Impact is further bounded to reading memory WITHIN the renderer sandbox: it grants no code execution, no integrity/availability impact, and no sandbox escape on its own, so it must be chained with another vulnerability to achieve meaningful compromise. |
| Impact | This is a medium-severity (CVSS 6.5) issue that does not rise to urgent priority despite the 'High' Chromium internal rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw, but one that REQUIRES user interaction (UI:R) and yields only confidentiality impact (C:H, I:N, A:N) confined to the renderer sandbox (S:U, and the description explicitly states the read is 'inside the sandbox'). The signals are mutually consistent rather than conflicting: EPSS is low at 0.22% (11th percentile), there is no CISA KEV listing, and no public exploit code is identified in the provided data - i.e., no public exploit identified at time of analysis. The alignment of low EPSS, absence of KEV, and info-disclosure-only impact indicates a real-but-low-urgency memory-disclosure bug rather than a widely weaponized threat. Its practical attacker value is as an information-leak primitive (e.g., to defeat ASLR) that would need chaining with a separate sandbox-escape/RCE bug to be dangerous; alone it cannot execute code or escape the sandbox. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content that drives Chrome's ANGLE component into an out-of-bounds read, then lures a Windows Chrome user (pre-156.0.8078.47) to visit it. When the page renders, the OOB read leaks adjacent memory from within the renderer sandbox into attacker-observable state, potentially revealing sensitive data or pointers useful for bypassing ASLR. No public exploit code is identified at time of analysis, and success depends on the victim opening the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An out-of-bounds read in Chrome's ANGLE graphics backend on Windows lets a remote attacker disclose renderer memory by getting a victim to load a crafted HTML page that exercises the WebGL/GPU rendering path. Only Windows installations prior to 156.0.8078.47 are affected, and exploitation requires user interaction - the target must navigate to the attacker's page - with the leak confined to memory inside the renderer sandbox, so there is no code execution, no integrity or availability impact, and no sandbox escape by itself. Google's internal rating is High, but the practical risk is moderate (CVSS 6.5, EPSS 0.22% / 11th percentile) and no public exploit was identified at time of analysis; the flaw is fixed in the 156.0.8078.47 stable channel release.
RemediationAI
Upgrade Google Chrome on Windows to 156.0.8078.47 or later - the fix ships in the stable channel release described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (also tracked as EUVD-2026-105461). Confirm the build on affected hosts via chrome://version, and push the update through your normal patch-management or enterprise update policy (Chrome for Enterprise / Google Update) rather than relying on users to restart browsers. Vendor-released patch: 156.0.8078.47. If immediate upgrade is not possible, reduce exposure by disabling WebGL and hardware acceleration (Chrome settings, or the --disable-webgl / --disable-gpu startup flags, or the corresponding enterprise policies), which blocks the ANGLE rendering path this bug lives in but degrades or breaks GPU-accelerated web apps, maps and 3D content; restricting users to trusted sites provides only limited benefit since a single crafted page is sufficient. Because the impact is confined to an in-sandbox memory read, severity is moderated further by keeping renderer sandboxing enabled and prioritizing the update alongside rather than ahead of higher-risk, actively exploited issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chromium uses to map OpenGL ES / WebGL API calls onto the platform's native graphics stack - most notably Direct3D on Windows - so that GPU-accelerated canvas and WebGL content renders correctly. Because that path involves parsing and copying attacker-influenced buffer, texture and shader data between JavaScript-controlled inputs and driver-facing structures, memory-safety errors there are reachable from ordinary web content. This instance is CWE-125 (out-of-bounds read): a missing or insufficient bounds check causes the engine to read past the end of an allocated buffer, and the over-read contents surface back to the attacker through the rendered WebGL result, i.e. a sandbox-internal information disclosure. It does not corrupt memory (no write primitive), so it yields no direct code execution; the leaked data would be useful primarily as an ASLR/heap-layout aid when chained with a separate memory-corruption bug. Per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, the attack is network-delivered and unauthenticated but conditional on the victim opening a malicious page. The issue was reported through Google's chromium CVE process and affects only the Windows build prior to 156.0.8078.47.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote via a crafted web page with no privileges but requiring the victim to visit it (UI:R); an out-of-bounds read discloses sandbox memory, so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB