External risk intelligence

ANGLE Out of Bounds Write in Chrome Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-95331

The vulnerability affects a web browser, which is an application designed specifically to process untrusted content from the public internet. While it requires user interaction, it is a primary internet-facing tool commonly exposed to malicious web pages in normal use.

Out-of-bounds Write

Google Chrome

before 154.0.8037.57

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in ANGLE, a component used by Google Chrome, could allow a remote attacker to execute code outside of the browser's security sandbox through a malicious webpage.

A browser flaw could enable code execution.
This affects common internet browsing activities.
Confirm if our systems use affected browsers.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by luring a user to a malicious webpage. When the user visits this page, the crafted content can trigger an out-of-bounds write within the ANGLE component of the browser. This flaw could allow an attacker to execute code outside the browser's security sandbox.

Entry condition: User visits a malicious webpage.
Trigger point: Browser processes crafted HTML page.
Resulting risk: Code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code outside of the browser's sandbox when a user visits a specially crafted HTML page. The ANGLE component, responsible for graphics rendering, has an out-of-bounds write that could be leveraged to bypass security boundaries.

Arbitrary code execution outside sandbox.
Attacker crafts malicious HTML page.
Sandbox escape leading to system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in Google Chrome, impacting its ANGLE component. Ownership typically falls to the platform team responsible for browser deployment and management, with assistance from security operations for initial triage and vendor management for coordinating with Google. The immediate practical step is to confirm the reachability and business criticality of Chrome instances, identify the accountable owners for those instances, and then plan remediation based on the assessed risk and operational impact.

Platform team owns the vulnerability.
Verify Chrome reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's ANGLE component?

ANGLE is a graphics engine abstraction layer within Google Chrome. It translates high-level graphics commands into formats understood by your computer's specific hardware drivers, such as OpenGL or DirectX. This ensures that web-based 3D content and visual elements render correctly across different devices and operating systems.

How does an out-of-bounds write manifest in CVE-2026-95331?

This vulnerability, classified as CWE-787, occurs when the software writes data past the end of the intended memory buffer. In this specific case, the browser’s graphics processing fails to enforce memory boundaries while handling content. This memory corruption can be leveraged to alter program execution flow, potentially allowing an attacker to run unauthorized commands outside the browser's protective sandbox.

Does simply opening Chrome trigger this vulnerability?

No, simply launching the browser does not trigger the flaw. The vulnerability requires a specific trigger path: the user must actively navigate to a malicious website containing crafted HTML content. If the browser never encounters the specific, malformed graphics instructions embedded in an attacker-controlled page, the flawed memory operation is not performed.

Why is this CVE considered high risk by Halo Surface Signal?

Halo Surface Signal identifies this as a significant concern because web browsers are designed to constantly fetch and process untrusted content from the public internet. Since the browser serves as a primary gateway to external web pages, it is inherently exposed to malicious sites that could weaponize this graphics rendering flaw during a standard browsing session.

How do I address CVE-2026-95331 in my environment?

The primary response is to ensure Google Chrome is updated to version 154.0.8037.57 or later. Since the flaw exists within the browser software itself, applying the vendor-supplied update is the required action. Administrators should verify that their automated update channels have successfully transitioned all endpoints to this secure version to neutralize the risk of sandbox escape.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.