CVE-2026-113143 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the ANGLE component of Google Chrome, specifically affecting versions prior to 156.0.8078.47, represents a critical class of software defects known as memory corruption errors. ANGLE serves as the translation layer between web applications and underlying graphics hardware APIs such as OpenGL ES or Vulkan, enabling browsers like Chrome to render complex visual content efficiently across diverse platforms. When this component contains flaws that allow for improper handling of memory allocation or access boundaries, it creates an attack surface where malicious actors can exploit unintended behavior in the browser's rendering engine. In this specific instance, the flaw was classified with a medium security severity by the Chromium team, indicating that while the issue is significant enough to warrant immediate attention and patching, it may not immediately lead to full system compromise without additional exploitation steps or specific environmental conditions.
The technical nature of this vulnerability centers on an out-of-bounds read condition within the ANGLE library. This type of memory corruption typically arises when a program accesses data at a memory location that is outside the intended buffer boundary, often due to incorrect index calculations or missing bounds checks during graphics processing operations. An attacker could craft a malicious HTML page containing specially designed JavaScript and WebGL content that triggers this erroneous access pattern within the ANGLE translation layer. By carefully constructing inputs that manipulate how graphical primitives are processed, the attacker forces the browser to read from memory locations it should not have access to. This bypasses standard sandboxing protections if the exploited code path allows for information leakage beyond the isolated renderer process context, although modern browsers employ multiple layers of defense such as site isolation and hardware-assisted virtualization to mitigate these risks.
The operational impact of this vulnerability is primarily focused on confidentiality rather than integrity or availability. A successful exploitation would allow a remote attacker to read arbitrary memory contents from the browser's address space. This could potentially lead to the disclosure of sensitive information stored in memory, such as session cookies, authentication tokens, private keys, or other user data that has been loaded into the process during normal browsing activities. While an out-of-bounds read is generally less severe than a write vulnerability because it does not directly allow code execution, it serves as a powerful primitive for reconnaissance and information gathering. Attackers can use this capability to map memory layouts, bypass address space layout randomization by leaking pointer addresses, or extract cryptographic material that could compromise the security of encrypted communications. The medium severity rating reflects the fact that while data exfiltration is possible, achieving arbitrary code execution typically requires chaining multiple vulnerabilities together, making standalone exploitation more complex and less likely in real-world scenarios compared to high-severity memory corruption flaws like heap overflows or use-after-free errors.
To mitigate this risk, users must ensure they are running Google Chrome version 156.0.8078.47 or later, as the vendor has released a patch that addresses the underlying logic error in the ANGLE component. Organizations should enforce automated update policies to minimize the window of exposure for their endpoints. From a defensive posture perspective, while software updates are the primary remediation strategy, additional controls such as enabling site isolation features and keeping hardware drivers up to date can further reduce the attack surface. Security teams should also monitor for indicators of compromise related to unusual memory access patterns or anomalous network traffic originating from browser processes, which might indicate an active exploitation attempt against unpatched systems.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-125, which describes out-of-bounds read conditions where a program reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this flaw supports techniques categorized under ATT&CK Tactic TA0006 for Credential Access and potentially TA0007 for Discovery, as leaking memory contents can reveal credentials or system configuration details. The incident underscores the importance of rigorous code review practices in graphics libraries that handle untrusted input from web pages, ensuring that all array indices and buffer boundaries are strictly validated before access is permitted to prevent information leakage through side channels or direct memory reads.