CVE-2026-110152 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments on Android, especially those exposed to untrusted web content, should prioritize upgrading to the latest version. This vulnerability could potentially allow remote code execution outside the sandbox, making it a high-risk issue for affected systems.

Why it matters

CVE-2026-110152 is a critical buffer overflow vulnerability in Google Chrome's ANGLE on Android, potentially allowing remote code execution outside the sandbox. Defenders should prioritize upgrading Chrome to version 155.0.8059.79 or later, especially for systems exposed to untrusted web content.

• Potential remote code execution outside the sandbox
• Elevation of privileges on affected Android systems
• Data tampering or theft via crafted HTML pages
• Increased risk for Android systems with Chrome exposed to untrusted content

Technical summary

The buffer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome on Android prior to 155.0.8059.79 could allow a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. This vulnerability is considered critical by the Chromium security team. The issue arises from a buffer overflow in the ANGLE component used by Chrome on Android. Defenders should prioritize upgrading Chrome to version 155.0.8059.79 or later, especially for systems exposed to untrusted web content.

Defensive priority

High priority for Chrome on Android users, especially those exposed to untrusted web content.

Recommended defensive actions

• Upgrade Google Chrome on Android to version 155.0.8059.79 or later
• Ensure that Chrome is configured to automatically update
• Monitor Chrome's version and update as necessary
• Consider implementing additional security measures for high-risk deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program and NVD records confirm the buffer overflow vulnerability in Google Chrome's ANGLE on Android. The CVE description and Chromium security severity indicate a critical vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.