CVE-2026-113266 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the ANGLE graphics library, which is integrated into Google Chrome for Android prior to version 156.0.8078.47, represents a critical memory corruption flaw that undermines the browser's sandboxing mechanisms. ANGLE serves as an intermediary layer that translates OpenGL ES API calls into native platform-specific graphics APIs such as Vulkan or DirectX, enabling consistent rendering across diverse hardware configurations on Android devices. When this component processes malformed input data derived from a crafted HTML page, it fails to properly validate memory boundaries or handle buffer operations correctly. This failure results in conditions where an attacker can write beyond the allocated limits of a buffer, leading to heap corruption or stack overflow scenarios that disrupt normal program execution flow and allow for arbitrary code execution within the context of the browser process.
From a technical perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and potentially CWE-787 Out-of-bounds Write depending on the specific memory state at the time of exploitation. The presence of such vulnerabilities in graphics processing components is particularly dangerous because these modules often operate with elevated privileges relative to other browser processes or require direct access to hardware resources for performance optimization. By exploiting this weakness, a remote attacker can bypass standard security mitigations and achieve code execution inside the sandboxed environment that Chrome employs to isolate web content from the underlying operating system. This isolation is designed to prevent malicious websites from accessing sensitive user data or modifying system files, but successful exploitation effectively neutralizes these protections by gaining control over the process memory space.
The operational impact of this vulnerability extends beyond simple code execution within a single tab. If an attacker can execute arbitrary commands inside the sandbox, they may attempt further privilege escalation attacks to break out of the browser container and gain access to the host Android operating system. This could lead to full device compromise, allowing for data exfiltration, installation of persistent malware, or use of the infected device as part of a botnet. The severity rating of High assigned by Chromium security teams reflects the likelihood of exploitation given that it can be triggered via standard web technologies like HTML and JavaScript without requiring user interaction beyond visiting a maliciously crafted webpage. This ease of delivery makes it a significant threat to mobile users who frequently browse untrusted sites or encounter drive-by download attempts through compromised advertising networks.
To mitigate this risk, immediate action is required by updating Google Chrome on Android devices to version 156.0.8078.47 or later, where the underlying memory management issues in ANGLE have been addressed and validated. Users should ensure that automatic updates are enabled to receive security patches promptly as they become available. Additionally, organizations deploying mobile browsers for employees should enforce strict update policies through Mobile Device Management solutions to prevent exposure to known vulnerabilities. Security teams should also monitor network traffic for indicators of compromise associated with exploit kits targeting this specific version range and consider implementing content security policies that restrict the execution of untrusted scripts where feasible. Awareness training regarding phishing attempts that may deliver such crafted HTML pages remains a vital complementary defense layer against social engineering tactics used to trigger these technical exploits.