CVE-2026-3536
8.8Google · Chrome
An integer overflow vulnerability in the ANGLE component of Google Chrome allows remote attackers to perform out of bounds memory access via a crafted HTML page.
Executive summary
A critical integer overflow vulnerability in Google Chrome, specifically within the ANGLE graphics engine, enables remote attackers to execute unauthorized memory access and potentially compromise system integrity.
Vulnerability
The vulnerability is an integer overflow (CWE-472) occurring within the ANGLE graphics component. It allows an unauthenticated, remote attacker to trigger out of bounds memory access by enticing a user to navigate to a specifically crafted HTML page.
Business impact
The potential for out of bounds memory access introduces significant risk, as it can be leveraged to facilitate arbitrary code execution or cause application crashes. Given the CVSS score of 8.8, this flaw represents a High severity risk that could lead to full system compromise or sensitive data exposure if successfully exploited by an attacker.
Remediation
Immediate Action: Update all Google Chrome instances to version 145.0.7632.159 or later immediately.
Proactive Monitoring: Review browser logs and endpoint security telemetry for unusual crash patterns or unexpected process behavior associated with web rendering tasks.
Compensating Controls: Utilize browser-based security policies or enterprise management tools to restrict the execution of untrusted scripts and enforce the latest stable channel updates across the organization.
Exploitation status
Public Exploit Available: Unknown.
Analyst recommendation
This vulnerability poses a substantial threat to workstation security due to the prevalence of the Chrome browser and the nature of the ANGLE component. Administrators must prioritize the deployment of the provided security update across all managed endpoints to neutralize this risk effectively.