EUVD-2026-105712
GHSA-6vm4-gx72-qggj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitDeliver malicious ANGLE content via browser
-
ExecutionTrigger improper access control in ANGLE
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use Google Chrome prior to 156.0.8078.47 and to actively visit or render an attacker-controlled crafted HTML page that drives the ANGLE graphics backend (UI:R - user interaction is mandatory). The defining limiting factor is that resulting code execution is confined to the Chrome renderer sandbox: without a chained sandbox-escape vulnerability, the attacker cannot reach the host OS, which is why the vendor rated the issue Low despite the network/unauthenticated vector. No authentication is required (PR:N), and default Chrome configurations with GPU/ANGLE rendering enabled are affected. |
| Impact | Signals conflict sharply and must be weighed carefully. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a remote, low-complexity, unauthenticated flaw needing only user interaction - the classic 'visit a malicious page' browser-exploit profile. However, Google's own Chromium security team rated this 'Low', a direct contradiction that is almost certainly explained by the description's key qualifier: code execution occurs INSIDE the Chrome renderer sandbox. The sandbox is designed to contain exactly this outcome, so without a chained sandbox-escape this is not a full host compromise - the 8.8 score materially overstates real-world impact. No EPSS probability is provided, the CVE is NOT on CISA KEV, and no public exploit (POC) is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net: patch promptly through normal Chrome update cadence, but this is a high-CVSS/low-real-risk item in isolation (sandbox-contained, vendor-rated Low) rather than an emergency - its danger rises only if combined with a sandbox-escape bug. EPSS and KEV data being absent is expected for a freshly disclosed Chrome CVE and is not itself an anomaly. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page that abuses the improper access control in Chrome's ANGLE graphics layer; a victim running a pre-156.0.8078.47 Chrome visits the page and the attacker gains arbitrary code execution within the renderer sandbox. No public exploit code is referenced in the provided data, and because execution is sandbox-confined, a separate sandbox-escape would be required to compromise the host. Exploitation requires the user to actively navigate to the attacker's page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper access control in Chrome's ANGLE graphics layer enables remote code execution inside the browser sandbox on Google Chrome versions earlier than 156.0.8078.47 when a victim renders a crafted HTML page. The CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but Google rates it Low because the impact is confined to the renderer sandbox and no sandbox escape is shown; exploitation requires user interaction, authentication is not required per PR:N, and no public exploit identified at time of analysis. The conflicting signals - high CVSS and RCE/authentication-bypass tags versus vendor Low and sandbox-only impact - should be weighed when prioritizing.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later; the fix is documented in the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and the installed version can be verified at chrome://version. Because exploitation requires rendering a crafted HTML page in an affected browser, prioritize updates for users who browse untrusted content and enforce browser update policies. If immediate upgrade is not possible, temporarily disabling hardware acceleration and/or WebGL can reduce exposure to ANGLE-driven rendering paths, but this degrades graphics performance and breaks some web applications; keeping the renderer sandbox enabled limits the blast radius but does not prevent the in-sandbox code execution. No standalone workaround beyond patching is identified in the supplied data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map OpenGL ES and WebGL calls onto platform graphics APIs such as Direct3D, Metal, and Vulkan. CVE-2026-113029 is classified as CWE-284 (Improper Access Control), indicating that authorization or boundary checks in ANGLE's handling of graphics resources exposed to renderer content were insufficient, allowing a crafted page to drive ANGLE into executing attacker-controlled code in the sandboxed browser process. The security consequence is bounded by Chrome's sandbox: code execution occurs inside the sandbox, and host compromise would require a separate sandbox-escape chain; this explains the vendor's Low severity despite the 8.8 CVSS base score. The affected component ships with Google Chrome before 156.0.8078.47; no CPE strings were supplied, and the Chromium issue is https://issues.chromium.org/issues/523708661.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the user to visit it (UI:R); arbitrary code execution yields high C/I/A, though confined to the unchanged sandbox scope (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome installations earlier than 156.0.8078.47 are exposed to a high-CVSS code-execution flaw in the ANGLE graphics layer, but Google's Low vendor rating reflects that the impact is contained within the renderer sandbox and no public exploit identified at time of analysis. Leadership should care because Chrome is broadly deployed and a crafted page could execute code with the user's browser privileges, yet the lack of a demonstrated sandbox escape and the availability of a vendor patch keep enterprise-wide risk manageable if remediation is tracked.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB