Description
Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in ANGLE, the graphics abstraction layer used by Google Chrome. The vulnerability allows an attacker to craft an HTML page that causes Chrome on Android to free a memory region and then reuse it, enabling the execution of arbitrary code outside the standard sandbox. This can lead to full system compromise, as the attacker can run native code with the privileges of the user or the device.

Affected Systems

The flaw affects Google Chrome browsers running on Android devices with versions older than 155.0.8059.39. Users of this pre‑155.0.8059.39 version are at risk. The vulnerability is not present in Chrome releases from 155.0.8059.39 onward.

Risk and Exploitability

Chromium rates this flaw with a CVSS score of 9.6, indicating critical severity. The EPSS score is currently unavailable, and the vulnerability is not recorded in the CISA KEV catalog. An attacker can trigger the exploit remotely by delivering a specially crafted HTML page when the affected Chrome process parses it. The requirement of an evil HTML page that is loaded locally or over the network makes exploitation possible from standard web content, implying a likely remote attack vector.

Generated by OpenCVE AI on October 7, 2026 at 02:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome on Android to version 155.0.8059.39 or newer.
  • Ensure automatic updates are enabled so future patches are applied promptly.
  • If waiting for updates, restrict Chrome’s ability to load untrusted web content by using safe browsing settings or extensions that block malicious HTML.
  • As a temporary measure, users can force software rasterization via Chrome flags to graphics performance.

Generated by OpenCVE AI on October 7, 2026 at 02:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in ANGLE Enables Remote Code Execution Outside Sandbox in Android Chrome chromium-browser: Use after free in ANGLE
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 07 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in ANGLE Enables Remote Code Execution Outside Sandbox in Android Chrome

Wed, 07 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:55:34.288Z

Reserved: 2026-10-06T16:38:38.497Z

Link: CVE-2026-106419

cve-icon Vulnrichment

Updated: 2026-10-06T19:26:45.478Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:11.670

Modified: 2026-10-07T13:10:35.167

Link: CVE-2026-106419

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:09Z

Links: CVE-2026-106419 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T02:45:10Z

Weaknesses