CVE-2026-106247: Google Chrome ANGLE Buffer Overflow Flaw

CVE-2026-106247 Overview

CVE-2026-106247 is a heap buffer overflow vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this vulnerability to execute arbitrary code outside the browser sandbox using a crafted HTML page. The weakness is tracked as CWE-122 (Heap-based Buffer Overflow).

Critical Impact
Successful exploitation enables a sandbox escape, allowing arbitrary code execution in the GPU process context from a compromised renderer.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.39
ANGLE graphics component bundled with Chromium-based browsers
Chromium-derived browsers that have not integrated the upstream fix

Discovery Timeline

2026-10-06 - CVE-2026-106247 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-106247

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which translates WebGL and OpenGL ES API calls into platform-specific graphics commands. A heap-based buffer overflow in ANGLE allows an attacker to write beyond allocated memory boundaries in the GPU process. Because ANGLE runs in a less restrictive process than the renderer, exploitation extends attacker control beyond the renderer sandbox. The attack requires user interaction, typically visiting a crafted HTML page, and the exploitation complexity is high due to prerequisite renderer compromise.

Root Cause

The root cause is improper bounds checking during ANGLE's processing of graphics commands or shader data. Insufficient validation of buffer sizes before memory operations enables heap corruption. Chromium security engineers classified the underlying bug severity as Low, but the sandbox escape potential elevates the CVSS impact to High.

Attack Vector

Exploitation requires a two-stage chain. First, an attacker must compromise the renderer process through a separate vulnerability or malicious content. Second, the attacker leverages the ANGLE buffer overflow by sending crafted WebGL commands or graphics payloads from the compromised renderer. A user must visit an attacker-controlled page or load malicious content for the chain to execute. Successful exploitation yields code execution in the GPU process, bypassing renderer sandbox restrictions.

No public proof-of-concept exploit is available at this time. Refer to the Chromium Issue #524435922 tracker for additional technical context once access restrictions are lifted.

Detection Methods for CVE-2026-106247

Indicators of Compromise

Unexpected crashes or termination of the Chrome GPU process (chrome.exe --type=gpu-process) with heap corruption signatures
Chrome child processes spawning unusual descendants such as command shells or script interpreters
Outbound network connections originating from the GPU process to untrusted hosts

Detection Strategies

Monitor Chrome process trees for anomalous parent-child relationships involving the GPU process
Correlate browser crash telemetry with visits to recently loaded URLs containing WebGL or canvas-heavy content
Deploy EDR behavioral rules to flag memory corruption patterns and unexpected code execution within browser subprocesses

Monitoring Recommendations

Collect and centralize Chrome crash reports and Windows Error Reporting (WER) data for GPU process failures
Track installed Chrome versions across the fleet and alert on hosts running builds prior to 155.0.8059.39
Enable browser telemetry forwarding to a SIEM for correlation with endpoint identification events

How to Mitigate CVE-2026-106247

Immediate Actions Required

Update Google Chrome to version 155.0.8059.39 or later on all managed endpoints
Restart browser sessions after patching to ensure the vulnerable ANGLE library is unloaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor patches that incorporate the upstream ANGLE fix

Patch Information

Google released the fix in the Stable Channel update documented at the Google Chrome Stable Update advisory. Enterprises using managed deployments should push the update through Group Policy, Microsoft Intune, Jamf, or equivalent configuration tooling. Verify patch application by checking chrome://version on representative endpoints.

Workarounds

Disable hardware acceleration in Chrome settings to reduce ANGLE attack surface, accepting performance trade-offs
Restrict WebGL by setting enterprise policy DefaultWebGLSetting to blocked for untrusted sites
Enforce Site Isolation and strict renderer sandboxing policies via Chrome enterprise configuration

bash

# Configuration example - Chrome enterprise policy to disable WebGL
# Windows registry path
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebGLSetting /t REG_DWORD /d 2 /f

# macOS plist equivalent
defaults write com.google.Chrome DefaultWebGLSetting -int 2

# Verify installed Chrome version meets patched baseline
google-chrome --version