CVE-2026-113200 in Chrome
Summary
by MITRE • 10/21/2026
Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as a use-after-free flaw within the ANGLE graphics library, present in versions of Google Chrome prior to 156.0.8078.47, represents a critical memory safety issue that undermines the browser's sandboxing mechanisms. ANGLE serves as the translation layer between web applications and native GPU drivers, converting OpenGL ES calls into DirectX or Vulkan commands. When this component is compromised by improper memory management, it creates an opportunity for remote code execution with significant consequences for system security. The core technical flaw involves a pointer to a previously freed memory block being accessed after its deallocation. In the context of ANGLE, this typically occurs when graphics objects such as textures or buffers are destroyed while still referenced by active rendering commands or asynchronous processing queues. If an attacker can control the data written into that reclaimed memory region before it is reallocated for another purpose, they can manipulate program execution flow. This specific type of vulnerability falls under CWE-416, which classifies use-after-free errors as a distinct category of software defects leading to unpredictable behavior and potential exploitation.
The operational impact of this flaw is severe because it allows an attacker to bypass the browser's sandbox environment. Modern browsers rely on strict isolation between web content and system resources to prevent malicious scripts from accessing sensitive data or executing arbitrary code with elevated privileges. By exploiting a use-after-free condition in ANGLE, a remote attacker can craft a specific HTML page that triggers the invalid memory access during rendering operations. This exploitation path enables the injection of shellcode into the browser process space, potentially leading to full system compromise if additional vulnerabilities are chained together or if sandbox escape techniques are employed. The Chromium security team has classified this issue with a medium severity rating, reflecting its potential for remote code execution while acknowledging that successful exploitation may require specific conditions such as particular GPU hardware configurations or driver versions. This classification underscores the importance of timely patching to mitigate risks associated with complex memory corruption bugs in high-performance graphics libraries.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later, where these memory management issues have been addressed through rigorous code reviews and automated fuzzing tests. Developers should ensure that all references to ANGLE objects are properly invalidated upon destruction to prevent dangling pointers from being used in subsequent rendering passes. Additionally, enabling hardware acceleration safeguards and keeping GPU drivers up to date can reduce the attack surface by ensuring compatibility with security patches applied at multiple layers of the stack. From a defensive perspective, organizations should monitor for indicators of compromise related to unusual memory allocation patterns or unexpected process behavior that might signal an attempted exploitation of this vulnerability. Security teams must also consider implementing browser hardening policies and restricting execution permissions where possible to limit the impact if such vulnerabilities are exploited in the wild. The ATT&CK framework categorizes this type of attack under techniques involving client-side code injection and sandbox escape, highlighting the need for comprehensive endpoint detection and response capabilities to identify anomalous activities stemming from memory corruption exploits.