CVE-2026-0908: Google Chrome ANGLE Use-After-Free Flaw

CVE-2026-0908 Overview

CVE-2026-0908 is a Use After Free vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome prior to version 144.0.7559.59. This memory corruption flaw allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution within the browser context.

Critical Impact

Successful exploitation of this use-after-free vulnerability could allow attackers to execute arbitrary code, compromise user data, or take control of affected systems through specially crafted web pages.

Affected Products

• Google Chrome versions prior to 144.0.7559.59
• Chromium-based browsers using vulnerable ANGLE component
• All platforms running affected Chrome versions (Windows, macOS, Linux)

Discovery Timeline

• 2026-01-20 - CVE CVE-2026-0908 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0908

Vulnerability Analysis

This vulnerability resides in the ANGLE component, which is Google Chrome's graphics abstraction layer responsible for translating OpenGL ES API calls to the underlying platform's native graphics API (Direct3D on Windows, OpenGL on other platforms). ANGLE is critical for WebGL rendering and hardware-accelerated graphics in the browser.

The use-after-free condition (CWE-416) occurs when the application continues to reference memory after it has been freed. In this case, the vulnerability exists within ANGLE's memory management routines, where an object in the heap can be accessed after deallocation. This creates a dangling pointer scenario that attackers can exploit to corrupt heap metadata or overwrite critical data structures.

Exploitation requires user interaction—specifically, visiting a malicious webpage containing crafted HTML content designed to trigger the vulnerable code path in ANGLE. Once triggered, an attacker could potentially achieve heap corruption, which may lead to arbitrary code execution with the privileges of the browser process.

Root Cause

The root cause is a use-after-free memory safety error in ANGLE's heap management. The vulnerability arises when an object is freed but a pointer to that object remains in use. Subsequent operations using the stale pointer can read or write to memory that has been reallocated for different purposes, leading to heap corruption.

This type of vulnerability typically occurs due to:

• Improper object lifecycle management
• Missing reference counting or incorrect reference handling
• Race conditions between object destruction and access
• Failure to nullify pointers after freeing associated memory

Attack Vector

The attack vector is network-based, requiring a victim to visit a malicious website. The attacker constructs a specially crafted HTML page that triggers the use-after-free condition in the ANGLE graphics layer. The attack flow typically involves:

1. Victim navigates to attacker-controlled webpage
2. Malicious JavaScript or WebGL content triggers specific ANGLE code paths
3. The vulnerability causes memory to be freed prematurely
4. Subsequent access to freed memory enables heap corruption
5. Attacker leverages heap corruption to achieve code execution

The vulnerability manifests in the ANGLE graphics layer during WebGL or Canvas rendering operations. Technical details regarding the specific trigger mechanism can be found in the Chromium Issue Tracker Entry. For the official security advisory, see the Google Chrome Desktop Update.

Detection Methods for CVE-2026-0908

Indicators of Compromise

• Unexpected browser crashes or instability when visiting untrusted websites
• Chrome crash reports indicating heap corruption in ANGLE-related modules
• Unusual WebGL or graphics rendering errors followed by process termination
• Memory access violations in Chrome renderer processes related to GPU operations

Detection Strategies

• Monitor Chrome browser version across endpoints and flag versions prior to 144.0.7559.59
• Implement network monitoring for suspicious HTML/JavaScript payloads targeting graphics APIs
• Deploy browser-based endpoint detection to identify exploitation attempts targeting WebGL/ANGLE
• Analyze crash dumps for patterns consistent with use-after-free exploitation in graphics components

Monitoring Recommendations

• Enable Chrome's built-in crash reporting and monitor for ANGLE-related crashes
• Implement SentinelOne's behavioral AI to detect exploitation attempts and post-exploitation activity
• Monitor for abnormal GPU process behavior or unexpected child process spawning from Chrome
• Review endpoint security logs for indicators of browser-based exploitation chains

How to Mitigate CVE-2026-0908

Immediate Actions Required

• Update Google Chrome to version 144.0.7559.59 or later immediately
• Enable automatic updates in Chrome to receive future security patches promptly
• Consider temporarily restricting access to untrusted websites until patching is complete
• Review and update any Chromium-based applications or embedded browsers in your environment

Patch Information

Google has addressed this vulnerability in Chrome version 144.0.7559.59. The patch corrects the use-after-free condition in the ANGLE component by properly managing object lifecycles and ensuring memory is not accessed after being freed.

Organizations should prioritize upgrading to the patched version. The official release notes and patch details are available in the Google Chrome Desktop Update.

Workarounds

• Disable WebGL in Chrome by navigating to chrome://flags/#disable-webgl and setting it to Disabled (may impact web application functionality)
• Enable Chrome's site isolation feature for additional process-level protection
• Utilize browser sandboxing and ensure it remains enabled to limit exploitation impact
• Implement network-level blocking for known malicious domains until patching is complete

# Verify Chrome version on Windows (PowerShell)
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe').'(Default)' | ForEach-Object { & $_ --version }

# Verify Chrome version on Linux/macOS
google-chrome --version

# Ensure version is 144.0.7559.59 or later