CVE-2026-0908
📋 TL;DR
This CVE describes a use-after-free vulnerability in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome that could allow heap corruption. Attackers could exploit this by tricking users into visiting a malicious HTML page. All Chrome users prior to version 144.0.7559.59 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or malware installation.
Likely Case
Browser crash or instability, with potential for limited data exposure from browser memory.
If Mitigated
No impact if Chrome is updated to patched version or if exploit attempts are blocked by security controls.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious page) and bypassing Chrome's sandbox protections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 144.0.7559.59 and later
Vendor Advisory: https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html
Restart Required: Yes
Instructions:
1. Open Chrome 2. Click menu (three dots) → Help → About Google Chrome 3. Chrome will automatically check for and install updates 4. Click 'Relaunch' to restart Chrome
🔧 Temporary Workarounds
Disable JavaScript
allPrevents malicious HTML pages from executing exploit code
chrome://settings/content/javascript → Block
Enable Site Isolation
allAdds process separation between sites to limit impact
chrome://flags/#enable-site-per-process → Enable
🧯 If You Can't Patch
- Use browser extensions that block malicious sites and scripts
- Implement network filtering to block known malicious domains
🔍 How to Verify
Check if Vulnerable:
Check Chrome version in About Google Chrome pageCheck Version:
google-chrome --versionVerify Fix Applied:
Confirm Chrome version is 144.0.7559.59 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports
- Renderer process termination events
Network Indicators:
- Requests to suspicious domains with HTML payloads
SIEM Query:
source="chrome" AND (event="crash" OR event="renderer_killed")