Google has issued an emergency security update for the Chrome web browser across Windows, macOS, Linux, and Android platforms, addressing a high-consequence buffer overflow vulnerability tracked as CVE-2026-110152 (Critical Severity). The vulnerability resides in ANGLE, Chromium's cross-platform graphics translation abstraction engine, allowing malicious websites to achieve arbitrary memory writes and code execution inside the GPU process.

Technical Root Cause in ANGLE Graphics Translation (CWE-120)

ANGLE (Almost Native Graphics Layer Engine) acts as an intermediary translation layer that converts WebGL and OpenGL ES API calls into native platform hardware APIs (Direct3D 11 on Windows, Metal on macOS/iOS, and Vulkan on Linux/Android). This allows web browsers to deliver high-performance hardware-accelerated 3D rendering.

The flaw is situated within ANGLE's shader compiler and translation pipeline (src/compiler/translator/). When compiling complex, nested GLSL (OpenGL Shading Language) fragment shaders featuring recursive matrix transformations, the array bounds calculation logic incorrectly calculates the required destination buffer size for uniform parameter arrays. A maliciously structured shader payload causes the translator to write compiled bytecode past the boundary of the allocated heap buffer:

// Simplified illustration of ANGLE buffer calculation defect
void ShaderTranslator::EmitUniformArray(const UniformDeclaration& decl) {
    size_t requiredSize = decl.elementCount * decl.elementSize;
    // VULNERABILITY: Integer truncation in 16-bit offset calculation
    uint16_t allocatedBytes = (uint16_t)requiredSize; 
    
    char* targetBuffer = mBufferPool.Allocate(allocatedBytes);
    // Overflows heap buffer when requiredSize exceeds 65,535 bytes!
    memcpy(targetBuffer, decl.rawBytecode, requiredSize); 
}

Sandbox Escape & Threat Implications

In Chromium's multi-process architecture, rendering web content occurs inside an untrusted, highly restricted renderer sandbox. However, WebGL instructions are marshaled over IPC to the GPU process, which operates with significantly fewer OS sandbox restrictions to interface directly with kernel-mode graphics display drivers.

By exploiting CVE-2026-110152, an attacker navigating a victim to a booby-trapped web page can compromise the GPU process directly. When paired with secondary operating system kernel vulnerabilities, this provides a direct path to full endpoint compromise without user interaction.

Remediation & Version Verification

Enterprise system administrators and individual users must verify that all Chrome installations are updated to the following minimum patched releases:

  • Windows & macOS: Google Chrome version 155.0.8059.79 or 155.0.8059.80
  • Linux & Android: Google Chrome version 155.0.8059.79
  • Chromium Embedded Framework (CEF) / Electron: Developers must rebuild application binaries against Chromium milestone 155.0.8059.79 or later.

Users can trigger immediate background updates by navigating to chrome://settings/help within the browser address bar.