Google Chrome: Memory corruption in ANGLE allows sandboxed code execution
Summary
Google Chrome on Windows before 156.0.8078.47 contains a memory corruption flaw in ANGLE, the graphics translation layer of the browser. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user loads the page, and a sandbox escape would still be needed for full compromise.
Affected
- Google Chrome on Windows prior to 156.0.8078.47
- Linux and macOS: unknown whether affected; update all platforms
Fixed in
- Google Chrome 156.0.8078.47 or later (Stable channel update of 20 October 2026)
- Newer Stable builds are available; install the latest Stable version
Workaround
Unknown. No workaround is documented because a fixed build exists. Do not disable ANGLE or other components without vendor guidance.
Exploitation
- Exploited in the wild: unknown, nothing found in the sources reviewed; check CISA KEV
- Public proof of concept: none found; the Chromium bug is referenced but its content could not be verified
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Update Google Chrome on all Windows, macOS and Linux endpoints to the latest Stable version and verify versions on managed devices
- Update Chromium-based browsers such as Microsoft Edge after checking the vendor advisory
- Check whether the vulnerability appears in KEV before closing the item
- Monitor for vendor updates and related CVEs (e.g. CVE-2026-113340, CVE-2026-113143) that may be listed separately
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD: CVE-2026-113285 vulners.com
- Chrome Releases: Stable Channel Update for Desktop (20 Oct 2026) chromereleases.googleblog.com
- Chrome Releases: Stable Channel Update for Desktop (27 Oct 2026) chromereleases.googleblog.com
- Chromium bug 563355257 issues.chromium.org
- Microsoft MSRC: CVE-2026-113285 msrc.microsoft.com
- Ubuntu security: CVE-2026-113285 ubuntu.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:16.
Original description (NVD)
Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.