{"id":"CVE-2026-113295","kind":"vulnerability","aliases":["CVE-2026-113295"],"related":[],"title":"Google Chrome: out-of-bounds read in ANGLE leaks sandboxed memory on Windows","description":"Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A crafted HTML page can make Chrome on Windows read memory outside a buffer in the ANGLE graphics layer. The read happens inside the browser sandbox, so an attacker could learn memory contents that help a later exploit.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"google chrome","fixed":["156.0.8078.47"],"affected":"< 156.0.8078.47","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","chrome","vendor","windows"],"not_affected_if":["chrome-updated"],"how_to_check":"- Open `chrome://version` in the browser and compare the version with `156.0.8078.47`.\n- On managed fleets, query the installed Chrome version with the endpoint management tool.","fix":"- Update Google Chrome on Windows to `156.0.8078.47` or later.\n- Restart the browser after the update so the new build is running.","status":"open","published_at":"2026-10-20T22:19:23+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","triaged_at":"2026-10-25T03:52:58+00:00","updated_at":"2026-10-25T03:52:58+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:52:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update Google Chrome on Windows to `156.0.8078.47` or later.\n- Restart the browser after the update so the new build is running.","reach":"internet","title":"Google Chrome: out-of-bounds read in ANGLE leaks sandboxed memory on Windows","impact":"low","summary":"A crafted HTML page can make Chrome on Windows read memory outside a buffer in the ANGLE graphics layer. The read happens inside the browser sandbox, so an attacker could learn memory contents that help a later exploit.","category":"vendor","nicknames":[],"who_cares":["chrome","windows","browser"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads sandboxed browser memory after a user visits a crafted page.","analyst_note":"","how_to_check":"- Open `chrome://version` in the browser and compare the version with `156.0.8078.47`.\n- On managed fleets, query the installed Chrome version with the endpoint management tool.","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Any Windows machine running Google Chrome before `156.0.8078.47` is exposed when a user visits a malicious or compromised web page. Servers and non-Windows clients are not named in the sources as affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000576,"input_tokens":3341,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113295':17A,20A '-2026':16A,19A '156.0.8078.47':79C 'allow':80C 'angl':9A,43B,70C 'attack':55B,83C 'bound':6A,67C 'browser':23B,51B 'buffer':40B 'chrome':2A,22A,24B,33B,73C 'chromium':95C 'content':59B 'could':56B 'craft':28B,92C 'cve':15A,18A 'exploit':64B 'googl':1A,72C 'google':21A 'graphic':44B 'happen':48B 'help':61B 'high':98C 'html':29B,93C 'insid':49B,87C 'later':63B 'layer':45B 'leak':10A 'learn':57B 'make':32B 'memori':12A,37B,58B,86C 'out-of-bound':3A 'outsid':38B 'page':30B,94C 'prior':77C 'read':7A,36B,47B,68C,85C 'remot':82C 'sandbox':11A,52B,89C 'secur':96C 'sever':97C 'vendor':25B 'via':90C 'window':14A,26B,35B,76C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine running Google Chrome before `156.0.8078.47` is exposed when a user visits a malicious or compromised web page. Servers and non-Windows clients are not named in the sources as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113295","severity":null,"published_at":"2026-10-20T22:19:23+00:00","modified_at":"2026-10-22T11:56:42+00:00","first_seen_at":"2026-10-23T21:57:24+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}