CVE-2026-113157 in Chrome
Summary
by MITRE • 10/21/2026
Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the ANGLE graphics library component of Google Chrome represents a critical class of memory safety issues that have historically plagued complex software systems relying on low-level resource management. ANGLE, which serves as an abstraction layer translating OpenGL ES calls to DirectX or Metal APIs, operates at a level where precise control over memory allocation and deallocation is paramount. In versions prior to 156.0.8078.47 for Windows, the implementation contained flaws that allowed for unauthorized access to sensitive data residing in process memory. This flaw was not merely theoretical but could be triggered by an attacker through a specifically crafted HTML page, leveraging browser-based rendering engines to execute malicious code within the context of the victim's browsing session. The severity is classified as medium because while it does not typically allow for arbitrary code execution or full system compromise on its own, the ability to read memory contents poses significant risks regarding data confidentiality and privacy.
From a technical perspective, this vulnerability aligns closely with CWE-200, which defines an Information Exposure where sensitive information is disclosed without explicit authorization. The root cause likely stems from improper handling of graphics resources or buffer boundaries within the ANGLE translation layer. When a malicious HTML page triggers specific rendering operations, it may exploit race conditions, use-after-free scenarios, or out-of-bounds reads to access memory regions that should remain isolated. These types of errors are particularly dangerous in browser environments because they can be triggered remotely without user interaction beyond visiting a webpage. The attacker crafts the payload to manipulate how ANGLE handles texture data, shader programs, or framebuffer objects, causing the application to leak pointers or actual content from adjacent memory blocks into accessible buffers that can then be read by JavaScript code embedded in the malicious page.
The operational impact of this vulnerability is primarily centered on privacy violations and potential secondary attacks facilitated by information leakage. An attacker who successfully exploits this flaw could extract sensitive data such as authentication tokens, session cookies, personal identifiable information, or proprietary content displayed within the browser window. This leaked information can be exfiltrated to a remote server controlled by the adversary. Furthermore, knowledge of internal memory layouts and object addresses obtained through such leaks can aid in developing more sophisticated attacks that bypass other security mitigations like Address Space Layout Randomization (ASLR). Although the immediate impact is limited to data disclosure rather than system takeover, the cumulative effect of repeated exploitation or combination with other vulnerabilities could lead to severe consequences for both individual users and enterprise environments relying on Chrome for secure web access.
In terms of threat modeling, this incident maps directly to MITRE ATT&CK technique T1005, which involves Data from Local System Retrieval via Application Programming Interfaces or memory scraping techniques. The attack vector is classified as Remote (Network) with High complexity due to the need for crafting specific HTML and JavaScript payloads that exploit browser-specific rendering behaviors. Defense in Depth strategies are essential here. Users must ensure their browsers are updated immediately to version 156.0.8078.47 or later, where these memory management flaws have been patched by Google’s Chromium security team. Additionally, enabling strict Content Security Policies and disabling unnecessary browser features can reduce the attack surface. For enterprise environments, deploying endpoint detection and response solutions that monitor for anomalous memory access patterns in Chrome processes can provide an additional layer of defense against exploitation attempts targeting this specific class of vulnerabilities.