Description
Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-11-03
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a buffer overflow in the ANGLE component of Google Chrome prior to version 157.0.8103.38. A remote attacker can deliver a crafted HTML page that triggers the overflow, allowing execution of arbitrary code outside the browser sandbox. The impact is a full compromise of the affected system with no limitation to the sandboxed environment.

Affected Systems

Google Chrome versions earlier than 157.0.8103.38, including all desktop implementations of the stable channel, are affected. The issue is specific to the ANGLE graphics engine used by Chrome on Windows, macOS, and Linux.

Risk and Exploitability

Chromium classifies this flaw with high severity. No exploit score (EPSS) is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been confirmed. The attack requires an active web session where the vulnerability is triggered by a malicious page, making remote code execution possible in a standard browsing context.

Generated by OpenCVE AI on November 3, 2026 at 22:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 157.0.8103.38 or later
  • Ensure that Chrome’s automatic update mechanism is enabled so future patches are applied without manual intervention
  • If an update cannot be applied immediately, consider using a separate, sandboxed browsing environment or a more secure browser that offers stronger isolation until the fix is available

Generated by OpenCVE AI on November 3, 2026 at 22:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via ANGLE Buffer Overflow in Google Chrome

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-121
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:32:10.426Z

Reserved: 2026-11-03T10:34:37.437Z

Link: CVE-2026-121249

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:35.493

Modified: 2026-11-03T22:19:45.487

Link: CVE-2026-121249

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:00:08Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow