---
id: "CVE-2026-113029"
kind: "vulnerability"
aliases: ["CVE-2026-113029"]
title: "Chrome: ANGLE access control flaw lets a web page run code in sandbox"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "google chrome", "fixed": ["156.0.8078.47"], "affected": "< 156.0.8078.47", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chrome", "desktop", "other", "package"]
not_affected_if: ["already-on-156.0.8078.47-or-later"]
published_at: "2026-10-20T22:18:53+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T22:38:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113029", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Chrome: ANGLE access control flaw lets a web page run code in sandbox

A crafted HTML page can exploit an improper access control bug in ANGLE, the graphics layer in Google Chrome, to execute arbitrary code inside the browser sandbox. The sources say the attacker can potentially do this from a remote page, and the source rates the issue high (CVSS 8.8) while Chromium rates it low.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:google chrome affected < 156.0.8078.47 fixed 156.0.8078.47

## How to check

Run chrome://version in Chrome and check whether the version is below 156.0.8078.47.

## Fix

Update Google Chrome to 156.0.8078.47 or later.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113029

## From the sources

Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_