Google Chrome: Use-after-free in ANGLE allows code execution outside sandbox
Summary
A use-after-free flaw in the ANGLE graphics layer of Google Chrome on Android allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, for example via a malicious website or phishing link. The CVSS score is 9.6 (Critical), and the vendor rates the Chromium severity as High.
Affected
- Google Chrome on Android prior to 155.0.8059.39
- Desktop fixes for the same branch were released as 155.0.8059.39/.40 (Windows, macOS) and 155.0.8059.39 (Linux); the Android fix version rests on the CNA record and third-party reporting.
Fixed in
- Chrome for Android 155.0.8059.39 or later
- Later builds on the same branch (155.0.8059.79/.80 and 155.0.8059.84/.85) and newer stable releases are also available; use the newest stable build.
Workaround
- No workaround is documented in the CVE record. Update Chrome instead.
- Unknown: whether interim browser hardening mitigates this flaw.
Exploitation
- No evidence of in-the-wild exploitation found as of late October 2026.
- No CISA KEV listing found.
- Public proof-of-concept: Unknown.
Our recommendation
- Update Chrome on all Android devices to 155.0.8059.39 or later, preferably the newest stable build, and verify the version under Chrome settings.
- Check that Android devices in the fleet receive Chrome updates and are not left on older versions.
- Also verify desktop Chrome installations on Windows, macOS and Linux.
- Monitor for exploitation reports and apply further updates promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Malwarebytes: Update Chrome and ChromeOS to fix critical security issues www.malwarebytes.com
- Malwarebytes: Update Chrome, Google fixes 37 security flaws www.malwarebytes.com
- OpenCVE: CVE-2026-106419 app.opencve.io
- OffSeq Radar: CVE-2026-106419 radar.offseq.com
- CIS Advisory: Multiple vulnerabilities in Google Chrome www.cisecurity.org
- GBHackers: Chrome 155 security flaws gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:11.
Original description (NVD)
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.