CVE-2026-3536: Google Chrome ANGLE RCE Vulnerability

CVE-2026-3536 Overview

CVE-2026-3536 is an integer overflow vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome prior to version 145.0.7632.159. This vulnerability allows a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The Chromium security team has rated this vulnerability as Critical severity.

Critical Impact
Remote attackers can exploit this integer overflow to achieve out-of-bounds memory access, potentially leading to arbitrary code execution or information disclosure through a maliciously crafted web page.

Affected Products

Google Chrome versions prior to 145.0.7632.159
Chrome on Microsoft Windows
Chrome on Apple macOS
Chrome on Linux

Discovery Timeline

2026-03-04 - CVE-2026-3536 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3536

Vulnerability Analysis

This vulnerability exists in ANGLE, Google Chrome's graphics abstraction layer that translates OpenGL ES API calls to the native graphics API of the host platform (DirectX, OpenGL, Vulkan, or Metal). The integer overflow condition (CWE-190) occurs during mathematical operations related to graphics rendering, where numeric values exceed their maximum representable size and wrap around to unexpected values.

The vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and CWE-190 (Integer Overflow or Wraparound). When exploited, the integer overflow leads to incorrect memory allocation size calculations, enabling subsequent out-of-bounds memory access operations.

Root Cause

The root cause is an integer overflow condition in ANGLE's graphics processing routines. When handling specially crafted input from a malicious HTML page, arithmetic operations on size or length values can overflow, causing memory buffers to be allocated with smaller sizes than expected. Subsequent operations then access memory beyond these undersized buffers.

Attack Vector

The attack is network-based and requires user interaction—specifically, convincing a victim to visit a malicious webpage. The crafted HTML page triggers the vulnerable code path in ANGLE during graphics rendering operations. An attacker can host the malicious page on a compromised or attacker-controlled website, or inject the malicious content through advertising networks or compromised legitimate sites.

The exploitation requires no special privileges and can be triggered simply by rendering malicious content in the browser. The vulnerability affects all major desktop platforms where Chrome is deployed, including Windows, macOS, and Linux.

Detection Methods for CVE-2026-3536

Indicators of Compromise

Unexpected Chrome browser crashes during webpage rendering, particularly on graphics-intensive pages
Memory access violations or segmentation faults in Chrome's GPU process
Anomalous network traffic to unknown or suspicious domains hosting crafted HTML content
Chrome crash reports indicating faults in libGLESv2.dll (Windows), libGLESv2.dylib (macOS), or equivalent ANGLE libraries

Detection Strategies

Monitor for Chrome crash dumps and memory corruption signatures associated with ANGLE or GPU process components
Deploy browser isolation solutions to contain potential exploitation attempts
Implement network-based detection for suspicious web page content patterns targeting graphics APIs
Enable Chrome's built-in crash reporting to identify potential exploitation attempts across the organization

Monitoring Recommendations

Enable enhanced logging for Chrome browser events and crash reports across endpoints
Monitor for unusual GPU process behavior including unexpected terminations and restarts
Implement endpoint detection rules for out-of-bounds memory access patterns in browser processes
Review web proxy logs for connections to newly registered or suspicious domains

How to Mitigate CVE-2026-3536

Immediate Actions Required

Update Google Chrome to version 145.0.7632.159 or later immediately across all managed endpoints
Enable automatic updates for Chrome to ensure future security patches are applied promptly
Consider temporarily disabling hardware acceleration in Chrome for high-risk environments until patching is complete
Educate users about the risks of visiting untrusted websites

Patch Information

Google has released a security update addressing this vulnerability. Update to Chrome version 145.0.7632.159 or later to remediate CVE-2026-3536. The patch information is available in the Google Chrome Desktop Update. Additional technical details can be found in the Chromium Issue Tracker Entry.

Workarounds

Enable Chrome's Software Rendering mode by launching with the --disable-gpu flag as a temporary measure
Implement web content filtering to block access to untrusted or potentially malicious sites
Use browser isolation technologies to contain any potential exploitation attempts
Deploy endpoint protection solutions capable of detecting memory corruption exploits

bash

# Temporary workaround: Launch Chrome with software rendering
# Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-gpu

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --disable-gpu

# Linux
google-chrome --disable-gpu