External risk intelligence

Chrome ANGLE Buffer Overflow Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-95284

This vulnerability affects a client-side web browser application. The attack requires a user to navigate to a crafted HTML page, meaning the surface is not a public-facing service, gateway, or network-accessible management interface that is reachable in common server-side deployments.

Buffer Overflow

Google Chrome

before 154.0.8037.57

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in ANGLE, a component used by Google Chrome on Android. This issue could allow a remote attacker to execute code on a user's device by luring them to a malicious website. The primary concern is to determine if our Android Chrome users are affected by this specific vulnerability.

Allows code execution through malicious websites.
Requires user interaction to exploit.
Confirm relevance for Android Chrome users.

Attack Path

How an attacker could exploit the issue

A remote attacker could execute arbitrary code outside the sandbox by tricking a user into visiting a specially crafted HTML page. This page would exploit a buffer overflow vulnerability within the ANGLE component of Google Chrome on Android.

Requires user interaction with a malicious page.
Exploits a buffer overflow in ANGLE.
Allows arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in ANGLE within Google Chrome on Android could allow a remote attacker to execute arbitrary code outside the browser's sandbox when a user visits a specially crafted HTML page. This could potentially lead to a compromise of the user's device.

User data and device integrity at risk.
Via crafted HTML page on a mobile device.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

The criticality of this buffer overflow vulnerability in ANGLE within Google Chrome on Android necessitates immediate action by teams managing Android devices and browser deployments. The first practical step is to identify all Android devices running affected versions of Chrome, assess their exposure to malicious websites, and confirm if they are business-critical assets. Subsequently, responsible owners should be identified to plan and execute the appropriate remediation.

Identify device owners and Crown Jewels.
Verify Chrome browser reachability on devices.
Plan remediation or deploy mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an abstraction layer that translates graphics calls from web content into the native format your device's hardware understands, such as OpenGL or Vulkan. It allows Chrome to render complex 3D graphics, animations, and games within the browser. In the context of Chrome on Android, it bridges the gap between web-based graphics instructions and the underlying device display drivers.

How does this buffer overflow vulnerability work in CVE-2026-95284?

This vulnerability is classified as CWE-122, a heap-based buffer overflow. It occurs when the ANGLE component attempts to write more data into a memory buffer than it is designed to hold. By sending specially crafted input via a malicious website, an attacker can overwrite adjacent memory. This process allows the attacker to bypass the browser's security sandbox and execute arbitrary commands directly on the device.

Does viewing a standard webpage trigger this Chrome vulnerability?

No, simply browsing standard, legitimate websites will not trigger this flaw. The attack requires the user to interact with a specifically crafted HTML page designed to exploit the buffer overflow in the ANGLE graphics component. Browsing websites that do not contain this malicious payload does not initiate the overflow condition.

Is my server infrastructure at risk from this Chrome issue?

According to Halo Surface Signal, this vulnerability is very unlikely to affect server infrastructure. It is a client-side issue specific to the Chrome application on Android devices. Because the attack requires a user to navigate to a crafted page, it does not represent a risk to public-facing network services, gateways, or management interfaces typically found in server-side environments.

What is the first step to secure devices against this CVE?

The immediate priority is to identify all Android devices within your organization that are running versions of Chrome older than 154.0.8037.57. Once these devices are located, you should initiate the standard update process to bring them to the latest secure version. Prioritize devices that access sensitive business data or are considered critical assets to minimize potential impact.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.