CVE-2026-19157 in Chrome
Summary
by MITRE • 08/07/2026
Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical out-of-bounds write condition within ANGLE graphics library component of Google Chrome on Android systems. ANGLE serves as a DirectX to OpenGL translation layer that enables Chrome to render graphics content efficiently on various platforms. The flaw exists in how the graphics subsystem handles memory allocation and bounds checking during rendering operations, specifically when processing crafted HTML content that triggers malformed graphics commands.
The technical implementation involves an attacker crafting a malicious HTML page containing specially constructed graphics elements or WebGL commands that cause the ANGLE library to write data beyond allocated memory buffers. This memory corruption occurs at the graphics rendering level where the translation layer between DirectX and OpenGL fails to properly validate input parameters or buffer boundaries during shader compilation or texture handling operations. The vulnerability's classification as critical severity stems from its potential for arbitrary code execution within the browser's sandboxed environment.
Operationally, this vulnerability enables remote attackers to potentially escape the browser sandbox through a carefully constructed web page that leverages the graphics rendering subsystem to overwrite memory regions controlled by the ANGLE component. The exploitation chain typically involves loading a malicious webpage that triggers specific rendering paths in the graphics library, where the out-of-bounds write corrupts memory structures that control program execution flow. This could allow attackers to execute arbitrary code with the privileges of the Chrome process, potentially leading to full system compromise or data exfiltration.
The impact extends beyond simple privilege escalation as this vulnerability affects users running vulnerable versions of Chrome on Android devices where ANGLE is actively used for graphics rendering. Attackers can leverage this weakness through web-based attacks without requiring user interaction beyond visiting a malicious website. The exploitability is enhanced by the fact that ANGLE operates at a low level in the graphics stack, making it difficult to detect or prevent through traditional browser security mechanisms. Mitigation strategies include immediate patching of Chrome to version 151.0.7922.109 or later, which contains fixes for the memory bounds checking issues in the ANGLE library. Additionally, users should maintain updated system software and consider implementing network-level protections such as content filtering and web application firewalls to reduce exposure to such attacks.
This vulnerability aligns with CWE-787 Out-of-bounds Write and relates to ATT&CK techniques involving privilege escalation through memory corruption exploits. The attack surface is particularly significant for mobile environments where graphics rendering performance optimizations may introduce additional complexity in memory management and bounds checking implementations. Security teams should prioritize patching this vulnerability across all affected Android devices and monitor for indicators of compromise related to browser-based exploitation attempts.