External risk intelligence

ANGLE Out-of-Bounds Write in Chrome for Android Enables Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-19157

The vulnerability exists in a web browser, which is a client-side application designed to render internet-accessible content. While it requires user interaction, the product is fundamentally built to interface with the public web, making it a common target for network-delivered, browser-based exploits.

Out-of-bounds Write

Google Chrome

before 151.0.7922.109

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ANGLE, a component used in Google Chrome on Android. This issue could potentially allow a remote attacker to escape the browser's security sandbox through a malicious HTML page, leading to significant compromise. The main concern is confirming the relevance and exposure of this vulnerability to our systems.

Allows bypassing browser security.
Critical vulnerability impacting user browsing.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could lure a user into visiting a malicious webpage. This page would leverage a flaw in how the ANGLE graphics component handles certain data. If successful, this could allow the attacker to break out of the browser's security sandbox.

Requires user to visit a malicious page.
Vulnerable ANGLE component mishandles data.
Risk of sandbox escape and further compromise.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in ANGLE, a component of Google Chrome on Android, could allow a remote attacker to escape the browser's sandbox. This could occur when a user visits a malicious HTML page, potentially leading to unauthorized access to system resources or sensitive information beyond the confines of the browser.

Sandbox escape.
User visits malicious webpage.
Compromise of system or data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ANGLE component within Chrome on Android is affected by an out-of-bounds write vulnerability that could lead to a sandbox escape. Given that this is a client-side application designed to render internet-accessible content, the first practical step is to identify all Android devices running affected Chrome versions, confirm their exposure to the internet or untrusted network segments, and then identify the business owner for those devices to prioritize remediation.

Own by Device or Application owners.
Verify internet-facing reachability.
Plan maintenance for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome on Android?

ANGLE is a software component that translates graphics commands into a format that the underlying Android hardware can understand. It acts as an abstraction layer, allowing Chrome to render web-based graphics consistently across various devices. Because it handles complex visual data, it is a critical piece of the browser's engine.

What does CVE-2026-19157 mean by an out-of-bounds write?

This vulnerability, classified as CWE-787, occurs when the software writes data beyond the memory boundaries it is intended to use. In this context, it means a crafted webpage can force the graphics engine to write information into unauthorized memory areas, which can be leveraged to escape the browser's security sandbox.

How does an attacker trigger this vulnerability?

An attacker triggers this by luring a user to visit a malicious HTML page. The flaw is not triggered simply by having the browser installed or running in the background; it requires the active rendering of specifically crafted web content that exploits how ANGLE processes data.

Why is this Chrome vulnerability considered a significant risk?

According to Halo Surface Signal, Chrome is designed to render internet-accessible content, making it a natural target for network-delivered threats. Because this flaw allows a sandbox escape, a successful attack could bypass the browser's primary security boundary, potentially allowing access to data or system resources outside the browser.

Do I need to update my devices to address CVE-2026-19157?

Yes. The first step is to identify all Android devices in your environment running versions of Chrome earlier than 151.0.7922.109. Once identified, prioritize applying the official update provided by the vendor, as this replaces the affected ANGLE component with a patched version that correctly validates memory write operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.