CVE-2026-110152: Chrome ANGLE Buffer Overflow Vulnerability

CVE-2026-110152 Overview

CVE-2026-110152 is a heap buffer overflow [CWE-122] in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Android. Versions prior to 155.0.8059.79 are affected. A remote attacker can trigger the overflow through a crafted HTML page and potentially execute arbitrary code outside the Chrome sandbox. Google rated the Chromium security severity as Critical. The vulnerability requires user interaction, such as visiting a malicious web page, but no authentication or elevated privileges.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox on Android devices by convincing a user to load a crafted HTML page.

Affected Products

Google Chrome for Android versions prior to 155.0.8059.79
ANGLE graphics abstraction layer bundled with Chrome
Chromium-based browsers on Android that embed the vulnerable ANGLE build

Discovery Timeline

2026-10-13 - CVE-2026-110152 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110152

Vulnerability Analysis

The flaw resides in ANGLE, the translation layer that converts OpenGL ES API calls into native graphics backends such as Vulkan on Android. A heap buffer overflow in this component allows a remote attacker to corrupt memory in the GPU process. Because the GPU process on Android operates with different sandbox constraints than renderer processes, successful exploitation can lead to code execution outside the Chrome sandbox. Attackers deliver the exploit through a crafted HTML page that issues malicious WebGL or graphics calls processed by ANGLE.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in ANGLE's handling of attacker-controlled graphics input. Insufficient bounds checking during buffer allocation or data copying permits writes beyond the allocated heap region. Technical specifics are tracked in Chromium Issue #567736859.

Attack Vector

Exploitation occurs over the network via a crafted HTML page. The user must load the malicious content, typically by clicking a link or visiting a compromised site. Once rendered, the page issues WebGL or graphics API calls that reach ANGLE and trigger the overflow. Successful exploitation can escape the renderer sandbox and achieve code execution in the GPU process context. Refer to the Google Chrome Stable Update advisory for release notes.

No public proof-of-concept or exploit code has been released. The EPSS probability is 0.254% at the 15.836 percentile as of 2026-10-14.

Detection Methods for CVE-2026-110152

Indicators of Compromise

Unexpected crashes of the Chrome GPU process on Android devices, especially after visiting unfamiliar sites
Chrome crash reports referencing ANGLE, WebGL, or graphics memory corruption
Outbound connections from mobile devices to attacker infrastructure following browser activity on untrusted pages

Detection Strategies

Inventory Chrome installations on managed Android devices and flag versions earlier than 155.0.8059.79
Monitor mobile device management (MDM) telemetry for Chrome version drift and failed update attempts
Analyze web proxy and DNS logs for Android browser connections to domains hosting WebGL-heavy or obfuscated content

Monitoring Recommendations

Enable Chrome crash reporting and forward GPU process crash data to a centralized log store for review
Correlate browser crash events with endpoint process activity to identify post-exploitation behavior
Track Chrome Stable channel release notes to detect new ANGLE or graphics-related advisories early

How to Mitigate CVE-2026-110152

Immediate Actions Required

Update Google Chrome on Android to version 155.0.8059.79 or later through the Google Play Store
Push mandatory Chrome updates to managed Android devices via MDM policies
Advise users to avoid untrusted links and web pages until all mobile browsers are patched

Patch Information

Google addressed CVE-2026-110152 in Chrome 155.0.8059.79 for Android. Users should install the latest Stable channel release from the Google Play Store. Release details are available in the Google Chrome Stable Update announcement.

Workarounds

No vendor-supplied workaround exists; patching is the only supported mitigation
Restrict browsing on unpatched Android devices to trusted sites via MDM-managed allowlists
Disable Chrome use on non-compliant devices until the update is confirmed installed

bash

# Verify Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output: versionName=155.0.8059.79 or higher