EUVD-2026-93814
GHSA-3m83-93r9-p973
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger use-after-free in ANGLE
-
ExploitCorrupt memory to gain code execution
-
ExecutionEscape renderer sandbox (scope change)
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to version 155.0.8059.39 (description specifies Android, though this conflicts with the Desktop-oriented reference and should be verified) to open an attacker-controlled HTML page that triggers the use-after-free in the ANGLE graphics component. No authentication is required (PR:N) and the attack is remote over the network (AV:N), but it cannot be fully automated against users without interaction: the user must navigate to or render the malicious page (UI:R), which is the primary limiting factor. The distinguishing severity driver is that successful exploitation executes code outside the browser sandbox (S:C), bypassing Chrome's main containment control. |
| Impact | All available signals point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-416 use-after-free in ANGLE) whose scope change (S:C) reflects the described escape 'outside the sandbox' - the most dangerous class of browser flaw because it breaks Chrome's primary containment boundary. The only mitigating metric is UI:R: a victim must load attacker-controlled content. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no evidence of active or imminent exploitation yet - exploitation status is 'no public exploit identified at time of analysis.' That said, sandbox-escape UAF bugs in Chrome's graphics layer are historically high-value targets frequently weaponized after patch disclosure, so the low observed exploitation signal likely reflects recency of disclosure rather than low exploitability. Note a data conflict to verify: the description states 'on Android,' but the sole vendor reference is a 'Stable Channel Update for Desktop' blog post and the CPE is the generic google:chrome with no platform qualifier - confirm whether the affected surface is Android, Desktop, or both with Google before scoping remediation. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted content that drives ANGLE (Chrome's graphics abstraction layer) into a use-after-free state. When a victim running a vulnerable Chrome build (prior to 155.0.8059.39) visits the page, the freed-object reuse is leveraged to corrupt memory and execute arbitrary code outside the renderer sandbox. No public exploit code was identified at time of analysis, and successful attack requires the user to open the attacker's page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Use-after-free in the ANGLE graphics layer of Google Chrome allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page; the vulnerable code path is present in Chrome builds prior to 155.0.8059.39. Exploitation is not automatic - the attacker must lure the user into rendering the malicious page (UI:R), but no credentials are required and the assessed CVSS:3.1 vector scores 9.6 with a scope change (S:C) because successful exploitation escapes Chrome's primary containment boundary rather than staying inside the renderer sandbox. Only publicly available exploit code would normally elevate this beyond an urgent patch-now item: at the time of analysis there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit identified, while a vendor patch is available. Note that the description scopes the flaw to Chrome on Android, whereas the only vendor reference is the Desktop stable-channel release notes - the affected platform should be verified against the vendor advisory before relying on a platform-specific assumption.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.39 - upgrade to 155.0.8059.39 or later and fully restart the browser (a restarted session is required for the GPU/ANGLE component to be replaced) as documented in the Stable channel release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with the upstream defect tracked at https://issues.chromium.org/issues/550379413. Android users should update through Google Play or their managed device policy; enterprises should force the minimum version through their update mechanism rather than relying on user action, since this is a remote, unauthenticated, user-interaction-driven bug. Until the update is deployed, the practical compensating control is to disable hardware acceleration in Chrome (Settings → System → 'Use graphics acceleration when available', or the equivalent enterprise policy) so that WebGL/compositing does not route through the ANGLE path - the trade-off is materially degraded rendering performance, possible breakage of WebGL-heavy applications, and an incomplete guarantee because software rasterization fallbacks may still process the same graphics content. Restricting users to trusted sites and blocking untrusted HTML/WebGL content at the network or extension layer reduces the chance of the required victim interaction, but is not a substitute for patching, and Chrome's renderer sandbox does not mitigate this issue because exploitation is assessed to escape it (S:C).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in ANGLE (Almost Native Graphics Layer Engine), the translation shim Chromium uses to map OpenGL ES/EGL calls onto native platform graphics APIs such as Vulkan, Direct3D and Metal. ANGLE services WebGL and graphics/compositing work for Chrome and lives behind the GPU process boundary, which is why the use-after-free of a graphics resource - for example a texture, buffer, shader program or context object freed while a reference to it remains reachable - can be re-triggered by attacker-influenced page content and then escalate into reuse of freed memory under attacker control. This class of bug is exploitable when the attacker can shape the contents of the freed allocation, turning a dangling pointer into an arbitrary write/read primitive; because the impacted component operates outside the renderer's script sandbox, the assessed scope is Changed (S:C) and the impact is a full compromise of confidentiality, integrity and availability of the host process, i.e. code execution outside the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the single affected product, and the Chromium issue tracker entry (issues.chromium.org/issues/550379413) is the upstream defect record; the fix landed in the Stable channel release 155.0.8059.39.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, low-complexity, unauthenticated web-page delivery sets AV:N/AC:L/PR:N; victim must load the page (UI:R); escape outside the sandbox forces S:C with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Android is affected by a critical use-after-free vulnerability in its ANGLE graphics layer that enables a remote attacker to execute arbitrary code outside the browser sandbox. Successful exploitation could allow an attacker to compromise the affected device, bypassing Chrome's primary containment boundary. Although no public exploit identified at time of analysis, the critical severity and sandbox escape capability warrant immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB