CVE-2026-110152
9.6CriticalPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Attackers can achieve remote code execution and escape the Chrome sandbox if a user visits a maliciously crafted HTML page. They require no authentication, only tricking the victim into navigating to the link.
Root cause
A heap-based buffer overflow flaw in the ANGLE graphics translation engine.
Affected systems
Google Chrome on Android prior to 155.0.8059.79
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Update Google Chrome on Android to version 155.0.8059.79 or later via the Google Play Store or your MDM. No interim configuration mitigation is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
References
- https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.htmlRelease NotesVendor Advisory
- https://issues.chromium.org/issues/567736859Permissions Required