Description
Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-01-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Heap Corruption via Use After Free
Action: Immediate Upgrade
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in the ANGLE component used by Google Chrome; a malicious web page can trigger heap corruption that may lead to arbitrary code execution or a denial‑of‑service within the browser process, and it is identified as CWE‑416.

Affected Systems

Google Chrome versions earlier than 144.0.7559.59 are affected on macOS, Windows, and Linux platforms where ANGLE is used, regardless of operating system.

Risk and Exploitability

With a CVSS score of 8.8 the flaw is high severity, yet the EPSS score is below 1 % and it is not present in the CISA KEV catalog, indicating a currently low exploitation probability. The remote attack vector relies on a crafted HTML page, which could be delivered via phishing or compromised sites, and successful exploitation would bypass sandboxing and allow arbitrary code execution, raising the risk for active users until the browser is updated.

Generated by OpenCVE AI on April 18, 2026 at 04:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 144.0.7559.59 or later to eliminate the use‑after‑free issue.
  • Enable automatic updates for Chrome so that future security patches are applied without manual intervention.
  • If immediate upgrade is not possible, temporarily disable hardware acceleration in Chrome (chrome://flags/#disable-gpu) to reduce ANGLE usage until the patch can be installed.

Generated by OpenCVE AI on April 18, 2026 at 04:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6100-1 chromium security update
History

Thu, 29 Jan 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Wed, 21 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in ANGLE
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 20 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Jan 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 20 Jan 2026 04:30:00 +0000

Type Values Removed Values Added
Description Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-416
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-02-26T14:44:44.939Z

Reserved: 2026-01-13T18:20:18.587Z

Link: CVE-2026-0908

cve-icon Vulnrichment

Updated: 2026-01-20T13:41:43.207Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-20T05:16:16.327

Modified: 2026-01-29T20:27:56.433

Link: CVE-2026-0908

cve-icon Redhat

Severity : Low

Publid Date: 2026-01-13T00:00:00Z

Links: CVE-2026-0908 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T05:00:06Z

Weaknesses