Google Chrome: Buffer overflow in ANGLE graphics layer
Summary
A heap-based buffer overflow (CWE-122) in the ANGLE graphics layer of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack requires only that a user visits a crafted HTML page, with no login needed. NVD lists a CVSS score of 9.6 (critical); the CVE record names Android, while secondary coverage says Windows, Mac and Linux are affected too.
Affected
- Google Chrome before 155.0.8059.79 on Android (per the CVE record)
- Secondary sources also list Chrome before 155.0.8059.79 on Windows, Mac and Linux; treat all platforms as affected until Google confirms
- Chromium-based browsers and Linux distributions may carry the flaw until they ship their own fixes
Fixed in
- Google Chrome 155.0.8059.79 or later (Android via Google Play)
- Windows and Mac: 155.0.8059.79 / .80 (per secondary sources)
- Linux: Chromium package updates from your distribution
Workaround
Unknown. No workaround is documented; apply the vendor update and restart the browser.
Exploitation
- Not listed in CISA KEV.
- Secondary reports state that Google's post mentions no attacks in the wild; this is not confirmed in the primary source.
- A public proof-of-concept repository exists, but its claims are unverified. Do not run untrusted exploit code.
Our recommendation
- Update Chrome to 155.0.8059.79 or later on all desktops and Android devices within days, using endpoint management.
- Restart the browser after updating, so the fixed code is loaded.
- Check Chromium-based browsers (such as Edge) and Linux Chromium packages.
- Confirm that BYOD Android phones receive the Play Store update.
- Monitor for a KEV listing or vendor exploitation updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Malwarebytes: Google fixes 37 security flaws including seven critical bugs www.malwarebytes.com
- Strix: CVE-2026-110152 www.strix.ai
- Vulners VulnRichment: CVE-2026-110152 vulners.com
- Windowsforum: Chrome 155.0.8059.79/.80 fixes 37 security flaws windowsforum.com
- Digitbin: Chrome 155 security update (critical) www.digitbin.com
- Neowin: Chrome gets 37 security fixes while Edge still waits www.neowin.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:51.
Original description (NVD)
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.