CVE-2026-113140 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an use-after-free flaw within the ANGLE graphics library, present in versions of Google Chrome prior to 156.0.8078.47, represents a critical memory safety issue that undermines the integrity of the browser's security model. ANGLE serves as the translation layer between web applications and native GPU drivers, converting OpenGL ES commands into DirectX or Vulkan calls depending on the host operating system. When this library is compromised by a use-after-free condition, it indicates that the application has attempted to access memory through a pointer after that memory had already been freed back to the system allocator. This scenario typically arises when an object's lifetime management fails to account for all references held within asynchronous operations or complex rendering pipelines, leading to dangling pointers that reference deallocated heap regions.
From a technical perspective, this flaw allows a remote attacker to achieve arbitrary code execution inside the browser sandbox by crafting a malicious HTML page. The attack vector relies on social engineering or drive-by download tactics where the victim visits a specially constructed webpage containing JavaScript and WebGL content designed to trigger the specific race condition or state mismatch in ANGLE. By carefully controlling the timing of memory allocation and deallocation, an attacker can manipulate the heap layout such that newly allocated data overwrites the freed memory region with controlled values. This manipulation enables the exploitation of type confusion or control flow hijacking techniques, allowing the execution of arbitrary machine code within the context of the renderer process.
The operational impact of this vulnerability is significant due to its potential for sandbox escape. Although Chromium classifies this issue as low severity based on the difficulty of exploitation and the presence of mitigations like ASLR and DEP, successful exploitation grants an attacker full control over the compromised renderer process. This level of access can be leveraged in conjunction with other vulnerabilities or browser-specific bugs to break out of the sandboxed environment, thereby gaining execution privileges at a higher system level. The ability to execute arbitrary code via a crafted HTML page highlights the persistent risks associated with complex graphics libraries and their integration into web browsers, where user interaction is often minimal but trust in rendered content is high.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, which includes patches that correct the memory management logic within ANGLE to prevent access to freed resources. Security administrators should ensure automated update policies are enforced across all endpoints to minimize exposure windows. Additionally, organizations can employ application whitelisting and restrict JavaScript execution in untrusted zones as defensive measures against drive-by attacks. From a standards perspective, this vulnerability aligns with CWE-416, which describes use after free errors, and is relevant to the ATT&CK technique of Initial Access via Spearphishing Link or Drive-by Compromise, emphasizing the need for robust patch management and user awareness training regarding suspicious web content.