External risk intelligence

ANGLE Memory Corruption Vulnerability in Google Chrome for Android

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121229

The vulnerability exists in the ANGLE graphics engine within the Google Chrome browser on Android. Exploitation requires a user to navigate to a crafted HTML page, which is a client-side execution pattern. It is not an internet-facing service, gateway, or appliance that is reachable or exploitable without specific user interaction in a client-side context.

Memory Corruption

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the ANGLE graphics engine within Google Chrome on Android could allow a remote attacker to execute code outside the browser's sandbox through a specially crafted webpage. This could potentially lead to broader system compromise if successful. The main concern is confirming relevance and exposure.

Code execution risk in Chrome on Android.
Attackers could exploit user interaction with web pages.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page. This page would then trigger a memory corruption vulnerability within the ANGLE component of Google Chrome on Android. If successful, this could allow the attacker to run their own code on the user's device, potentially bypassing security measures.

Requires visiting a malicious web page.
Triggers memory corruption in ANGLE.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in ANGLE, a graphics engine used by Google Chrome on Android, could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a malicious HTML page, potentially impacting the user's device and data.

Arbitrary code execution
Visiting a crafted HTML page
Device compromise and data exposure

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and platform teams are likely responsible for addressing this memory corruption vulnerability in ANGLE, which affects Google Chrome on Android. The initial practical step is to identify all Android devices running affected Chrome versions, assess their business criticality, and confirm their exposure. Following this, accountable owners should be identified to plan remediation, prioritizing devices that are both accessible and critical.

Own by platform and system owners.
Verify device reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome on Android?

ANGLE is an open-source graphics engine used by Chrome to translate complex web graphics commands into formats that the underlying device hardware understands. It acts as a bridge between the browser's high-level content and the phone's physical graphics processor, ensuring that web pages render visual elements consistently across various Android devices.

What does memory corruption mean in the context of CVE-2026-121229?

This vulnerability is a memory corruption flaw, classified as CWE-119. It occurs when a program mishandles data in its memory space, such as writing beyond intended boundaries. By exploiting this, a remote attacker can manipulate the browser's internal operations to force it to execute unauthorized commands outside of the protective sandbox environment.

How is this vulnerability triggered by an attacker?

The vulnerability is triggered when a user navigates to a specifically crafted HTML page designed to exploit the ANGLE engine. It does not trigger automatically; it requires the user to load malicious content. Simply having the browser installed or running in the background does not initiate the flaw.

How does Halo Surface Signal categorize this threat's reach?

Halo Surface Signal labels this as very unlikely to be an automated network threat because it relies on client-side execution. Since Chrome on Android is a user-facing browser rather than an internet-facing server or gateway, an attacker cannot reach it remotely without a user first interacting with the malicious webpage.

What is the first step for teams managing affected Android devices?

Prioritize identifying all Android devices currently running versions of Chrome older than 157.0.8103.38. Once these devices are located, assess their role and business importance to determine the urgency of updating the browser to a secure version that includes the necessary memory safety patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.