CVE-2026-76046 Overview
CVE-2026-76046 is a heap buffer overflow [CWE-122] in ANGLE, the graphics abstraction layer used by Google Chrome on Android. Versions prior to 151.0.7922.169 are affected. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page. Google rates the Chromium security severity as High. Successful exploitation escapes the renderer sandbox, giving the attacker code execution in a more privileged browser context on the target device.
Critical Impact
Sandbox escape via a crafted HTML page allows arbitrary code execution outside the renderer, expanding the blast radius of any prior renderer compromise on Android devices.
Affected Products
- Google Chrome for Android versions prior to 151.0.7922.169
- ANGLE component shipped within affected Chrome builds
- Chromium-based browsers on Android that embed the vulnerable ANGLE version
Discovery Timeline
- 2026-08-18 - CVE-2026-76046 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76046
Vulnerability Analysis
The flaw resides in ANGLE (Almost Native Graphics Layer Engine), which translates OpenGL ES calls issued by web content into the underlying graphics API on the host platform. On Android, ANGLE runs in the GPU process, a higher-privileged component than the renderer. A crafted HTML page can drive ANGLE into a heap buffer overflow condition [CWE-122]. Because ANGLE executes outside the renderer sandbox, corrupting its heap gives an attacker a path from a compromised renderer to code execution in the GPU process, effectively escaping the sandbox.
The attack requires user interaction, such as loading a malicious page, and depends on the attacker already controlling the renderer through a prior bug. This chained requirement raises the attack complexity but does not reduce the impact once the chain succeeds.
Root Cause
The root cause is improper bounds checking on heap-allocated buffers inside ANGLE when processing attacker-controlled graphics commands. Malformed WebGL or shader-related inputs from a compromised renderer trigger writes past the allocated boundary, corrupting adjacent heap metadata or function pointers used by the GPU process.
Attack Vector
Exploitation proceeds in two stages. First, the attacker compromises the renderer process, typically through a separate memory-safety bug reachable from a crafted HTML page. Second, the compromised renderer issues malicious IPC or graphics commands that trigger the ANGLE heap overflow, achieving code execution outside the sandbox. The vector is network-reachable and does not require authentication, but does require the victim to visit attacker-controlled content.
No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported for CVE-2026-76046 at the time of publication. Technical details are tracked in the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-76046
Indicators of Compromise
- Unexpected crashes or restarts of the Chrome GPU process on Android endpoints running versions earlier than 151.0.7922.169.
- Chrome telemetry entries referencing ANGLE heap corruption or abnormal libangle faults.
- Outbound connections from Chrome to previously unseen domains immediately following visits to untrusted sites.
Detection Strategies
- Inventory installed Chrome for Android versions across managed mobile fleets and flag any build older than 151.0.7922.169.
- Correlate browser crash reports with URL browsing history to identify pages that reliably trigger GPU process faults.
- Hunt for post-exploitation behavior such as unexpected child processes, file drops, or privilege changes originating from the Chrome application sandbox.
Monitoring Recommendations
- Ingest mobile browser crash and telemetry data into a centralized analytics platform for anomaly analysis.
- Alert on repeated GPU process crashes tied to a single origin or session.
- Track patch compliance for Chrome on Android as a first-class KPI in vulnerability management dashboards.
How to Mitigate CVE-2026-76046
Immediate Actions Required
- Update Google Chrome on Android to version 151.0.7922.169 or later through the Google Play Store or managed app distribution.
- Enforce minimum Chrome version policies via mobile device management (MDM) for enrolled Android devices.
- Restart the browser after updating to ensure the patched ANGLE library is loaded.
Patch Information
Google addressed CVE-2026-76046 in Chrome 151.0.7922.169 for Android. Patch details and release notes are available in the Google Chrome Desktop Update announcement, and the underlying bug is tracked in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing on unpatched devices to trusted sites until the update is installed.
- Disable hardware-accelerated graphics features in enterprise browser policies where feasible to reduce ANGLE attack surface.
- Apply network-layer filtering to block known malicious domains and reduce exposure to hostile HTML content.
# Verify installed Chrome version on Android via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output: versionName=151.0.7922.169 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
