CVE-2026-110152 in Chrome
Summary
by MITRE • 10/13/2026
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within the ANGLE graphics library, which is integrated into Google Chrome on Android prior to version 155.0.8059.79, represents a critical buffer overflow condition that undermines the browser's sandboxing mechanisms. This flaw arises from improper handling of memory allocation and bounds checking during the processing of graphical data structures or shader programs rendered through ANGLE. When an attacker crafts a malicious HTML page containing specific JavaScript code designed to trigger these graphics operations with oversized or malformed inputs, the application fails to validate the size of the input against the allocated buffer space. This lack of rigorous boundary verification allows excess data to spill over into adjacent memory regions, corrupting stack or heap metadata and potentially allowing an attacker to overwrite critical control flow data such as return addresses or function pointers.
From a technical perspective, this vulnerability is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Buffer Overflow. The exploitation vector relies on the browser's ability to execute complex rendering tasks in response to user interaction with web content. By leveraging JavaScript APIs that interface directly with WebGL or other graphics contexts managed by ANGLE, a remote attacker can construct a scenario where specific memory writes occur outside the intended boundaries. This overflow condition is particularly dangerous because it occurs within a context that may have elevated privileges relative to the standard sandboxed environment of typical browser tabs. The ability to write arbitrary data to adjacent memory locations provides the foundational primitive necessary for achieving code execution, as the attacker can manipulate program flow to redirect execution to shellcode injected into the process memory space.
The operational impact of this vulnerability is severe due to its classification as a critical severity issue by Chromium security teams and its potential for remote code execution outside the sandbox. In modern web browsers, the sandbox serves as the primary defense mechanism against malicious websites, restricting access to sensitive system resources such as file systems, network interfaces, and hardware devices. By escaping this sandbox through a buffer overflow in ANGLE, an attacker gains unrestricted access to the underlying operating system environment of the Android device. This escalation allows for full compromise of the user's data, installation of persistent malware, interception of communications, or use of the compromised device as part of a botnet. The risk is amplified by the fact that this vulnerability can be triggered simply by visiting a maliciously crafted webpage, requiring no additional interaction from the victim beyond loading the content in an affected browser version.
To mitigate this threat, users must immediately update Google Chrome on Android to version 155.0.8059.79 or later, where the underlying memory management routines in ANGLE have been patched with stricter bounds checking and input validation protocols. Security engineers should also monitor for indicators of compromise related to unusual graphics processing activity or unexpected privilege escalation events within browser processes. From a defensive posture perspective, this incident reinforces the importance of maintaining up-to-date software dependencies that handle low-level system interactions like graphics rendering. Furthermore, organizations relying on Chrome for enterprise browsing should ensure their mobile device management policies enforce automatic updates to prevent exposure to such critical vulnerabilities. The ATT&CK framework categorizes this type of exploitation under T1059, specifically Command and Scripting Interpreter, as the ultimate goal is often to execute arbitrary commands within the compromised environment after successfully bypassing sandbox restrictions through memory corruption techniques akin to those described in CWE-78 or related injection vectors depending on the specific payload delivery method.