{"id":"CVE-2026-121037","kind":"vulnerability","aliases":["CVE-2026-121037"],"related":[],"title":"Chrome on Windows: ANGLE memory write flaw lets crafted pages run code","description":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"An out-of-bounds write in the ANGLE graphics layer of Google Chrome on Windows lets a remote attacker craft an HTML page that can potentially execute code outside the browser sandbox. Chromium rates the flaw High severity.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","package","windows"],"not_affected_if":["chrome-updated","non-windows"],"how_to_check":"- Open Chrome, go to Settings > About Chrome, and read the installed version number.\n- Compare the installed version with the fixed release named in the fix field.","fix":"- Google Chrome on Windows: move to `157.0.8103.38` or later.","status":"open","published_at":"2026-11-03T21:17:07+00:00","first_seen_at":"2026-11-03T21:19:09+00:00","triaged_at":"2026-11-03T21:27:30+00:00","updated_at":"2026-11-03T21:27:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T21:27:30Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on Windows: move to `157.0.8103.38` or later.","reach":"internet","title":"Chrome on Windows: ANGLE memory write flaw lets crafted pages run code","impact":"high","summary":"An out-of-bounds write in the ANGLE graphics layer of Google Chrome on Windows lets a remote attacker craft an HTML page that can potentially execute code outside the browser sandbox. Chromium rates the flaw High severity.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","windows","browser"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code outside the browser sandbox after a visit","analyst_note":"","how_to_check":"- Open Chrome, go to Settings > About Chrome, and read the installed version number.\n- Compare the installed version with the fixed release named in the fix field.","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.38 or later: open Chrome, go to Settings > About Chrome, and let it update.","needs_analyst":false,"not_affected_if":["chrome-updated","non-windows"],"who_is_affected":"Any Windows computer running Google Chrome before 157.0.8103.38 is exposed, and the trigger is simply a visit to a malicious web page. Chromium browsers built on the same code may need their own updates, which the sources do not state. Machines that do not run Chrome on Windows can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4116,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121037':15A,18A '-2026':14A,17A '157.0.8103.38':76C 'allow':77C 'angl':4A,31B,67C 'arbitrari':84C 'attack':42B,80C 'bound':27B,64C 'browser':19B,54B 'chrome':1A,20B,36B,70C 'chromium':56B,94C 'code':12A,51B,85C 'craft':9A,43B,91C 'cve':13A,16A 'execut':50B,83C 'flaw':7A,59B 'googl':35B,69C 'graphic':32B 'high':60B,97C 'html':45B,92C 'layer':33B 'let':8A,39B 'memori':5A 'out-of-bound':24B 'outsid':52B,86C 'packag':21B 'page':10A,46B,93C 'potenti':49B,82C 'prior':74C 'rate':57B 'remot':41B,79C 'run':11A 'sandbox':55B,88C 'secur':95C 'sever':61B,96C 'via':89C 'window':3A,22B,38B,73C 'write':6A,28B,65C","nicknames":[],"mitigations":[],"who_affected":"Any Windows computer running Google Chrome before 157.0.8103.38 is exposed, and the trigger is simply a visit to a malicious web page. Chromium browsers built on the same code may need their own updates, which the sources do not state. Machines that do not run Chrome on Windows can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.38 or later: open Chrome, go to Settings > About Chrome, and let it update.","pkeys":[],"ptokens":[],"labels":["browser","chrome","high","package","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121037","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121037","severity":null,"published_at":"2026-11-03T21:17:07+00:00","modified_at":"2026-11-03T21:17:07+00:00","first_seen_at":"2026-11-03T21:19:09+00:00","fetched_at":"2026-11-03T21:19:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}