External risk intelligence

ANGLE Buffer Overflow in Google Chrome on Android Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-110152

This vulnerability affects the browser's graphics library (ANGLE) and requires a user to navigate to a crafted HTML page. It is a client-side component rather than an internet-facing service, gateway, or management interface. Its reachability depends on user interaction with untrusted web content rather than direct exposure of a server-side surface to the public internet.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts Google Chrome on Android, stemming from a buffer overflow within the ANGLE graphics library. While requiring user interaction with a malicious webpage, it carries the potential for attackers to execute code outside the browser's secure sandbox. The primary concern is confirming its relevance and potential exposure within our environment.

Graphics bug could allow code execution.
Users must visit a malicious page.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then leverages a flaw in the ANGLE graphics component within Chrome on Android. This could allow them to run unauthorized code outside of the browser's secure sandbox.

Entry condition: User visits a malicious HTML page.
Trigger point: Crafted HTML page in ANGLE.
Resulting risk: Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially execute arbitrary code outside the sandbox on Android devices when a user visits a malicious HTML page. This could impact the integrity and availability of the device's operating system and installed applications.

Device operating system and installed applications.
Visiting a crafted HTML page.
Arbitrary code execution outside the sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ANGLE, affecting Google Chrome on Android, allows remote code execution via a crafted HTML page. The primary responsibility for addressing this lies with the teams managing the Android application environment and those overseeing browser deployments. The first practical move involves identifying all Android devices utilizing the affected Chrome version, assessing the exposure by understanding user browsing habits and the potential for encountering malicious pages, and confirming the business criticality of these devices before planning remediation.

Own the risk and remediation effort.
Verify exposure and critical assets.
Plan coordinated updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome on Android?

ANGLE is an open-source graphics engine abstraction layer used by Chrome. It translates high-level graphics calls into formats the device's underlying hardware can understand. It is a critical part of how the browser renders web content, including complex visuals and 3D graphics, on Android devices.

What does CWE-122 mean for CVE-2026-110152?

CWE-122 identifies this as a heap-based buffer overflow. This occurs when the ANGLE component writes more data to a memory buffer than it can hold, effectively spilling over into adjacent memory. In this CVE, an attacker uses this memory corruption to bypass the browser's sandbox and potentially run unauthorized code.

How is this vulnerability triggered?

An attacker triggers this by convincing a user to navigate to a specifically crafted HTML page designed to exploit the ANGLE graphics flaw. Simply having the browser installed or running in the background does not trigger the bug; the active rendering of the malicious content by the browser is required.

Do I need to worry about this if my devices are internal?

According to Halo Surface Signal, this is not an internet-facing service or server-side gateway. Because the risk depends on a user interacting with untrusted web content, the vulnerability's reachability is tied to user browsing habits rather than the network location of the device.

When should I prioritize updates for this Chrome vulnerability?

You should begin by auditing your Android environment to identify devices running vulnerable versions of Chrome. Once mapped, prioritize updates for devices frequently used to access public web content, as these carry a higher likelihood of encountering the malicious pages required to trigger the overflow.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.