Google Chrome: Use-after-free in ANGLE graphics component on Windows
Summary
A use-after-free flaw in the ANGLE graphics component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page, for example through a link in a phishing email or a malicious website. Code execution is limited to the sandbox, so a second flaw would be needed for full system compromise. The vendor rates the issue as High severity.
Affected
- Google Chrome on Windows prior to 156.0.8078.47\n- Other platforms and Chromium-based browsers are not covered by this CVE record; check their own vendor advisories
Fixed in
- Google Chrome 156.0.8078.47 or later (per NVD and the vendor record)\n- Use the latest Chrome 156 stable build for the most recent fixes
Workaround
- No workaround documented. Apply the update and restart the browser so the patched binaries are loaded.
Exploitation
- No in-the-wild exploitation or public proof of concept known at the time of research.\n- CISA SSVC assessment: exploitation none, not automatable, total technical impact.\n- The CISA KEV catalogue was not checked directly.
Our recommendation
- Confirm that all Windows systems run Google Chrome 156.0.8078.47 or later, preferably the latest 156 stable build.\n- Enforce automatic updates through policy and check for devices that have not been restarted since the update.\n- Restart Chrome on all endpoints after updating.\n- Verify that other Chromium-based browsers on Windows are patched according to their vendors.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker 562040486 issues.chromium.org
- Vulners: CVE-2026-113293 (CVE list) vulners.com
- VulDB 424620 vuldb.com
- HKCERT security bulletin on Microsoft Edge vulnerabilities www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:13.
Original description (NVD)
Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.