Google Chrome: Improper input validation in ANGLE graphics layer
Summary
Google Chrome on macOS contains an improper input validation flaw in ANGLE, the graphics layer that processes WebGL and OpenGL ES calls. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user loads the malicious page, and the attacker still needs a separate sandbox escape for full system compromise.
Affected
- Google Chrome on macOS prior to 156.0.8078.47
- Chromium-based browsers that ship the same ANGLE code (for example Microsoft Edge), according to Microsoft
- Unknown: whether other platforms are affected, as the NVD entry lists only Mac
Fixed in
- Google Chrome 156.0.8078.47 or later for macOS (the NVD threshold)
- Current Mac builds are newer, e.g. 156.0.8078.74 per Google's download page
- Unknown: whether 156.0.8078.47 alone is sufficient or whether .48 was required
Workaround
- Unknown: no vendor workaround has been identified
- Patching is the required remediation
Exploitation
- No evidence of exploitation in the wild found
- No public proof-of-concept found
- CISA KEV status not verified (a third-party aggregator lists it as not KEV)
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Update Google Chrome on all Macs to the current stable release (156.x) via the built-in update mechanism
- Check the installed version via Chrome's About page in managed fleets
- Update Chromium-based browsers such as Microsoft Edge on macOS as well
- Apply the update through normal browser update cycles; priority medium to high because any website can deliver the attack
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD entry (vulners) vulners.com
- Chrome Releases: Stable Channel Update for Desktop (CVE advisory) chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft Security Update Guide msrc.microsoft.com
- VulDB entry vuldb.com
- Chrome Releases: Stable Channel Update for Desktop (27 October) chromereleases.googleblog.com
- Google Chrome download page (macUpdate) google-chrome.macupdate.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 13:56.
Original description (NVD)
Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.