CVE-2026-113285 in Chrome
Summary
by MITRE • 10/21/2026
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified involves a critical memory corruption flaw within ANGLE, which serves as Google Chrome's implementation of OpenGL ES for Windows systems. This component is responsible for translating graphics API calls into native hardware instructions, and its integration deep within the browser's rendering pipeline means that any instability or error in this layer can have severe security implications. The specific nature of the memory corruption suggests a failure in proper bounds checking or resource management during the processing of graphical data structures. Because ANGLE operates at a low level to ensure high-performance graphics rendering, errors here often manifest as buffer overflows or use-after-free conditions, which are among the most dangerous classes of software vulnerabilities due to their potential for arbitrary code execution.
The operational impact of this flaw is significant because it allows a remote attacker to execute arbitrary code within the browser's sandbox environment. Chrome employs a multi-process architecture where renderer processes run in a restricted security context known as the sandbox, designed to limit the damage an exploited vulnerability can cause by preventing access to sensitive system resources and user data. However, memory corruption vulnerabilities like this one provide attackers with mechanisms such as heap spraying or stack pivoting techniques that can bypass these isolation boundaries. By crafting a malicious HTML page containing specially constructed JavaScript and WebGL calls, an attacker can trigger the flaw in ANGLE, leading to control over instruction pointers or function return addresses. This effectively neutralizes the sandbox's protective measures, granting the attacker code execution privileges equivalent to those of the browser process itself.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific memory management failure observed in the ANGLE source code. These weaknesses are foundational to many successful exploits because they allow attackers to manipulate how data is stored and accessed in system memory. The severity rating of High by Chromium security teams reflects the direct path this vulnerability provides from a web-based attack vector to full compromise of the user's local environment, assuming no additional mitigating controls such as Data Execution Prevention or Address Space Layout Randomization are fully effective against the specific exploitation technique employed.
To mitigate the risks associated with this vulnerability, immediate action is required to update Google Chrome and its underlying Chromium components to version 156.0.8078.47 or later on Windows systems. This patch includes code changes that address the memory management errors within ANGLE, ensuring that input data is properly validated before being processed by graphics rendering routines. Organizations should enforce automated browser update policies to ensure all endpoints are protected against known exploitation techniques targeting this flaw. Additionally, deploying endpoint detection and response solutions with behavioral analysis capabilities can help identify attempts to exploit memory corruption vulnerabilities in real-time, providing an additional layer of defense beyond patch management. Users should also be educated on the risks of visiting untrusted websites or opening suspicious attachments that may contain crafted HTML pages designed to trigger such rendering engine flaws.