External risk intelligence

Chrome ANGLE Use After Free Vulnerability Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121148

This vulnerability affects a client-side web browser. While it requires a user to navigate to a crafted web page, the vulnerability itself is localized to the client-side browser application rather than being an internet-facing service, edge gateway, or server-side component. It does not involve a reachable network service or appliance in common deployments.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in ANGLE, a component used in Google Chrome, could allow an attacker to execute malicious code on a user's device. This occurs when a user visits a specially crafted web page, potentially leading to unauthorized actions outside the browser's protected environment.

Use-after-free flaw in ANGLE.
Affects Chrome users visiting malicious sites.
Confirm relevance and exposure for user-facing systems.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would then exploit a flaw in how the ANGLE component handles memory, potentially allowing the attacker to run their own code on the user's computer, even breaking out of the browser's security sandbox.

Requires user to visit a malicious page.
Triggered by a use-after-free memory error.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in ANGLE, a graphics engine used by Google Chrome, could allow a remote attacker to execute arbitrary code outside the browser's sandbox. This could occur when a user visits a specially crafted HTML page, potentially impacting the confidentiality, integrity, and availability of the user's browser session and any data accessible through it.

Browser sandbox escape.
Via crafted HTML page.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects client-side web browsers, specifically Google Chrome, and could allow for arbitrary code execution when a user visits a malicious HTML page. Determining precise ownership requires understanding how Chrome is deployed and managed within your environment. The first practical step is to inventory all endpoints running the affected Chrome version, assess their exposure to the internet or untrusted networks, and identify the systems or user groups most at risk.

Identify Chrome deployment owners.
Confirm browser reachability and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an abstraction layer that translates graphics calls from web applications into the native format your computer's graphics hardware understands. It is a critical part of how Chrome renders 3D graphics and visual content smoothly across different operating systems, acting as a bridge between the browser and your hardware's graphics drivers.

How does this use-after-free vulnerability work?

A use-after-free, classified as CWE-416, happens when software continues to use a memory location after it has been cleared or freed. In CVE-2026-121148, the browser's ANGLE component incorrectly manages this memory. An attacker can manipulate this flaw to replace the freed memory with their own data, eventually tricking the system into executing their malicious code instead of legitimate browser instructions.

Does simply having Chrome installed trigger this bug?

No. Simply having the browser installed or running is not enough to trigger this vulnerability. The flaw is only activated if a user actively navigates to a specific, maliciously crafted HTML page designed to exploit the memory error. It does not trigger during normal browsing of standard, secure websites.

Is my system at risk for CVE-2026-121148?

According to Halo Surface Signal, this is considered unlikely to impact server-side infrastructure because it is a client-side browser vulnerability. While the risk of arbitrary code execution is high for an individual, it does not involve an internet-facing network service or appliance that attackers can scan and compromise remotely without direct user interaction.

What should I do to secure my systems?

Your primary step is to identify all endpoints in your environment where Google Chrome is installed. Once you have an inventory, prioritize updating these installations to version 157.0.8103.38 or later. Since this is a browser-based risk, ensuring your users are on the latest patched version is the most effective way to close this security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.