{"id":"CVE-2026-126858","kind":"vulnerability","aliases":["CVE-2026-126858"],"related":[],"title":"Chrome on Windows: ANGLE graphics flaw lets web pages read memory","description":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"An uninitialized resource in the ANGLE graphics layer of Google Chrome on Windows lets a crafted HTML page read memory outside the browser sandbox. The sources describe it as a remote, web-triggered memory read with Chromium rating it High.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","package","windows"],"not_affected_if":["chrome-already-updated","non-windows"],"how_to_check":"- Open Chrome, go to Settings > About Chrome, and note the version number\n- Check whether the version is below `157.0.8103.78`","fix":"- Google Chrome on Windows: move to `157.0.8103.78` or later","status":"open","published_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:36+00:00","triaged_at":"2026-11-11T23:33:35+00:00","updated_at":"2026-11-11T23:33:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T23:33:35Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on Windows: move to `157.0.8103.78` or later","reach":"internet","title":"Chrome on Windows: ANGLE graphics flaw lets web pages read memory","impact":"medium","summary":"An uninitialized resource in the ANGLE graphics layer of Google Chrome on Windows lets a crafted HTML page read memory outside the browser sandbox. The sources describe it as a remote, web-triggered memory read with Chromium rating it High.","audience":"everyone","category":"package","nicknames":[],"who_cares":["chrome","windows","browser"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads browser process memory outside the sandbox from a web page","analyst_note":"","how_to_check":"- Open Chrome, go to Settings > About Chrome, and note the version number\n- Check whether the version is below `157.0.8103.78`","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.78 or later.","product_name":"","needs_analyst":false,"not_affected_if":["non-windows","chrome-already-updated"],"who_is_affected":"Chrome on Windows versions before 157.0.8103.78 are exposed when a user visits a page that carries the crafted HTML. Browser users are the ones at risk, so teams should push the update to managed Windows machines. Systems that do not run desktop Chrome on Windows can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4538,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126858':14A,17A '-2026':13A,16A '157.0.8103.78':75C 'allow':76C 'angl':4A,27B,66C 'attack':79C 'browser':18B,44B 'chrome':1A,19B,32B,69C 'chromium':59B,91C 'craft':37B,88C 'cve':12A,15A 'describ':48B 'flaw':6A 'googl':31B,68C 'graphic':5A,28B 'high':62B,94C 'html':38B,89C 'layer':29B 'let':7A,35B 'memori':11A,41B,56B,82C 'outsid':42B,83C 'packag':20B 'page':9A,39B,90C 'prior':73C 'rate':60B 'read':10A,40B,57B,81C 'remot':52B,78C 'resourc':24B,64C 'sandbox':45B,85C 'secur':92C 'sever':93C 'sourc':47B 'trigger':55B 'uniniti':23B,63C 'via':86C 'web':8A,54B 'web-trigg':53B 'window':3A,21B,34B,72C","nicknames":[],"mitigations":[],"who_affected":"Chrome on Windows versions before 157.0.8103.78 are exposed when a user visits a page that carries the crafted HTML. Browser users are the ones at risk, so teams should push the update to managed Windows machines. Systems that do not run desktop Chrome on Windows can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome on your Windows computer to version 157.0.8103.78 or later.","pkeys":[],"ptokens":[],"labels":["browser","chrome","high","package","windows"],"campaign_type":null,"search_a":"'-126858':14A,17A '-2026':13A,16A 'angl':4A 'chrome':1A 'cve':12A,15A 'flaw':6A 'graphic':5A 'let':7A 'memori':11A 'page':9A 'read':10A 'web':8A 'window':3A","search_b":"'angl':27B 'browser':18B,44B 'chrome':19B,32B 'chromium':59B 'craft':37B 'describ':48B 'googl':31B 'graphic':28B 'high':62B 'html':38B 'layer':29B 'let':35B 'memori':41B,56B 'outsid':42B 'packag':20B 'page':39B 'rate':60B 'read':40B,57B 'remot':52B 'resourc':24B 'sandbox':45B 'sourc':47B 'trigger':55B 'uniniti':23B 'web':54B 'web-trigg':53B 'window':21B,34B","search_c":"'157.0.8103.78':75C 'allow':76C 'angl':66C 'attack':79C 'chrome':69C 'chromium':91C 'craft':88C 'googl':68C 'high':94C 'html':89C 'memori':82C 'outsid':83C 'page':90C 'prior':73C 'read':81C 'remot':78C 'resourc':64C 'sandbox':85C 'secur':92C 'sever':93C 'uniniti':63C 'via':86C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126858","severity":null,"published_at":"2026-11-11T23:17:14+00:00","modified_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:36+00:00","fetched_at":"2026-11-11T23:29:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}