Google Chrome: Code execution outside the sandbox via ANGLE on Windows
Summary
Improper input validation in ANGLE, the graphics component of Google Chrome on Windows, affects Chrome versions prior to 156.0.8078.47. A remote attacker can craft an HTML page that may execute arbitrary code outside the browser sandbox. The attack requires that a victim opens the malicious page, for example via a phishing link, advertisement or compromised website.
Affected
- Google Chrome on Windows prior to 156.0.8078.47
- Chromium-based Microsoft Edge is listed as affected by the same Chromium issue; fixed Edge versions are unknown.
- Mac and Linux builds are not affected by this CVE according to the CVE description.
Fixed in
- Google Chrome 156.0.8078.47 or later for Windows (vendor table not fully retrieved; some Windows builds may show 156.0.8078.48)
- Newer Chrome 156 builds also contain the fix.
Workaround
- No vendor workaround known. Updating Chrome is the mitigation.
Exploitation
- CISA KEV: not listed (per third-party tracker).
- Exploitation in the wild: no evidence found; Google's text was not fully retrieved.
- Public proof of concept: none found.
- EPSS: unknown.
Our recommendation
- Update Chrome on all Windows systems to the latest stable release, not only to 156.0.8078.47.
- Restart the browser after updating, as pending updates are not active until restart.
- Check installed versions centrally, especially on office PCs where updates are often delayed.
- Update Chromium-based Edge via MSRC guidance.
- Train users to be cautious with unknown links and web pages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Microsoft MSRC entry via Vulners vulners.com
- CVE entry via Vulners vulners.com
- Strix CVE page www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:27.
Original description (NVD)
Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.