External risk intelligence

ANGLE Out-of-Bounds Write in Google Chrome Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121037

The vulnerability exists in a web browser (Google Chrome) which is a client-side application designed specifically to process untrusted content from the public internet. While it requires user interaction, the product role is fundamentally that of an internet-facing tool that renders remote web content, making exploitation via crafted HTML pages a standard and expected deployment scenario.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified within the ANGLE component of Google Chrome, affecting Windows users. This issue allows for potential arbitrary code execution outside the browser's security sandbox when a user visits a specially crafted webpage. This could have significant implications for user data and system integrity if exploited.

Attackers can run unauthorized code via websites.
It impacts a widely used internet browser.
Confirm if your environment is exposed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by crafting a malicious HTML page. When a user visits this page using a vulnerable version of Google Chrome on Windows, the ANGLE component could be tricked into writing data outside its intended memory boundaries. This could allow an attacker to execute their own code, potentially escaping the browser's security sandbox.

Requires user to visit a malicious website.
Crafted HTML page triggers out-of-bounds write.
Potential for arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this vulnerability by enticing a user to visit a malicious HTML page, potentially leading to arbitrary code execution outside the browser's sandbox. This could affect the integrity and confidentiality of the user's system when the browser is used to access untrusted content.

System integrity and user data confidentiality.
Via a crafted HTML page.
Arbitrary code execution outside the sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ANGLE component in Google Chrome is affected, indicating that Chrome browser owners, application owners who embed Chrome, and potentially platform or infrastructure teams responsible for managing browser deployments are involved. The initial step should be to identify all Chrome installations, determine their exposure to untrusted web content, and confirm which are business-critical. This will help prioritize remediation efforts and assign ownership.

Browser or application owners should own the issue.
Verify Chrome installations accessible externally.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE stands for Almost Native Graphics Layer Engine. It is an open-source software project that translates industry-standard graphics API calls, like OpenGL ES, into the native API calls supported by your computer's hardware. By doing this, it helps Chrome render complex web graphics and 3D content efficiently across different operating systems, including Windows.

What does an out-of-bounds write vulnerability mean for CVE-2026-121037?

This weakness, classified as CWE-787, occurs when software writes data past the end, or before the beginning, of the intended memory buffer. In this specific case, it allows an attacker to manipulate memory in a way that can lead to arbitrary code execution, potentially bypassing the security sandbox that normally isolates the browser from the rest of your computer system.

How is this vulnerability triggered by a website?

An attacker must entice a user to visit a specially crafted HTML page. The bug is triggered when the browser attempts to process the malicious code within that page. Importantly, simply having the browser installed or running it without visiting an untrusted or manipulated site does not trigger the memory write error.

Is my Windows system at risk if I use Chrome?

According to Halo Surface Signal, this vulnerability is significant because Google Chrome is designed to process untrusted content from the public internet. Because the browser's primary role involves rendering remote web pages, any installation used to browse the internet faces a higher risk of encountering the malicious content required to trigger this flaw.

What should I do to address this Google Chrome security issue?

The most effective first step is to verify the version of Chrome running on your Windows systems. Ensure all installations are updated to version 157.0.8103.38 or later. If you manage multiple machines or applications that embed Chrome, prioritize these updates to ensure the security patch is applied browser-wide, reducing the chance of code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.