External risk intelligence

ANGLE Input Validation Flaw in Chrome Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-91738

The vulnerability affects a widely deployed web browser. Web browsers are designed to render arbitrary content from the public internet, making them inherently internet-facing software that frequently processes untrusted remote content.

Google Chrome

before 153.0.8010.47

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in Google Chrome's ANGLE component could allow an attacker to execute malicious code on a user's system through a specially crafted webpage. This issue impacts web browsing capabilities and requires an update to mitigate potential risks.

Code execution flaw in Chrome's graphics component.
Widely used browser makes it a significant concern.
Confirm relevance and ensure browser updates are managed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into visiting a malicious website. This website would host specially crafted HTML content designed to interact with a vulnerable component within the ANGLE graphics library in the Chrome browser. Successful manipulation of this component could allow the attacker to execute code, bypassing the browser's security sandbox.

Remote attackers can exploit this vulnerability.
Triggered by visiting a malicious webpage.
Risk of arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

Improper input validation in ANGLE, when utilized by Google Chrome, could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a specially crafted HTML page. This could affect the security and integrity of the user's system when the browser is used to access malicious web content.

Arbitrary code execution on user systems.
Visiting a malicious HTML page.
Compromise of user's system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, used by Google Chrome, requires coordination between platform or infrastructure teams managing the browser deployment and potentially the security team for exposure assessment. The first step is to identify all Chrome instances, determine their reachability and business criticality, and then confirm the accountable owner for remediation planning.

Platform or infrastructure teams should own the issue.
Verify Chrome deployment reachability and criticality.
Plan remediation based on confirmed ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE (Almost Native Graphics Layer Engine) is a graphics abstraction layer used by Chrome to translate industry-standard graphics API calls into the specific APIs supported by a user's underlying hardware, such as DirectX, OpenGL, or Metal. By enabling consistent rendering of web-based 3D content and graphics across diverse hardware, it acts as a bridge between the browser's high-level content and the system's GPU.

What does CWE-20 mean for CVE-2026-91738?

CVE-2026-91738 involves a weakness classified as CWE-20, or Improper Input Validation. This means the ANGLE component fails to properly verify or sanitize data provided by a website before processing it. Because the browser assumes this incoming data is safe, a specially crafted HTML page can provide malicious instructions that force the graphics engine to misbehave, potentially leading to arbitrary code execution.

How is this Chrome vulnerability triggered?

An attacker triggers this bug by enticing a user to navigate to a malicious website containing specifically designed HTML content. Simply browsing to the page initiates the interaction with the vulnerable graphics component. It is important to note that typical, benign web browsing does not trigger this flaw; the vulnerability requires the specific, malicious input crafted by an attacker to bypass the browser's security controls.

Is my system relevant to this threat?

According to Halo Surface Signal, this vulnerability is highly relevant because Google Chrome is a widely deployed browser designed to process untrusted content from the public internet. Because it is inherently internet-facing, any system running a vulnerable version of Chrome while connected to the web is exposed to the risk of a remote attacker exploiting this flaw via a malicious webpage.

What is the first step to address this issue?

The primary step is to ensure that all Chrome instances in your environment are updated to version 153.0.8010.47 or later. Platform or infrastructure teams should begin by identifying where the browser is deployed, verifying the current version numbers against this requirement, and coordinating the rollout of the security update to ensure the vulnerable component is replaced with the patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.