CVE-2026-106419: Google Chrome on Android: Use After Free in ANGLE Graphics Library
CVE-2026-106419 is a use-after-free flaw (CWE-416) in the ANGLE graphics component of Google Chrome on Android, reported as affecting builds before 155.0.8059.39. According to the record, a remote attacker could exploit it through a crafted HTML page to execute arbitrary code outside the browser sandbox. The CNA assigns a CVSS score of 9.6 and a critical severity, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-106419 describes a use-after-free condition in ANGLE, the graphics abstraction layer used by Google Chrome. The vendor description states that Chrome on Android versions prior to 155.0.8059.39 are affected. The record classifies the weakness as CWE-416 (Use After Free).
Impact
The description states that a remote attacker could execute arbitrary code outside the sandbox by convincing a user to load a crafted HTML page. The CNA scores the issue at 9.6 with a critical severity. The vector in the record indicates network access, low complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Google Chrome on Android, before 155.0.8059.39.
- The record's affected entries are internally inconsistent (one range is written as below 155.0.8059.39 and a second range repeats the same endpoint), so the exact boundary should be confirmed against the vendor release notes.
- Whether desktop builds of Chrome are affected is not stated in the record.
Exploitation status
The CISA KEV catalogue does not list this CVE, and the record's SSVC exploitation field is set to none. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00338 (percentile 0.26044), which indicates low predicted exploitation likelihood at the time of the record.
Remediation and mitigation
- Update Google Chrome on Android to version 155.0.8059.39 or later, as indicated by the vendor description.
- Check the vendor release notes linked below to confirm the fixed build for your channel and device.
- Keep automatic updates enabled on managed Android devices and verify that the browser version reported by device management tools is current.
- Where updates cannot be applied immediately, limit browsing of untrusted web content on affected devices.
Detection guidance
- Inventory Android devices running Chrome and record their installed build numbers.
- Flag devices reporting builds older than 155.0.8059.39 for prioritised updating.
- Review browser crash reports and unexpected sandbox or renderer process events on affected devices as a general indicator of memory corruption attempts.
Limitations of the available information
The record does not include a populated fixes field, so the fixed build is taken from the vendor description rather than a structured fix entry. The affected version ranges are inconsistent. The record does not include proof-of-concept details, and this analysis does not describe exploitation steps. Vendor bug tracker access may be restricted, so further technical details are unknown.
Frequently asked questions
Which Chrome versions are affected by CVE-2026-106419?
According to the vendor description in the record, Google Chrome on Android versions before 155.0.8059.39 are affected. The record's affected entries are inconsistent, so confirm the exact boundary in the vendor release notes.
Is CVE-2026-106419 known to be actively exploited?
The CISA KEV catalogue does not list it, and no confirmed exploitation in the wild appears in the sources consulted. The record's SSVC exploitation field is set to none.
What should administrators do first?
Inventory Android devices running Chrome, prioritise any build older than 155.0.8059.39 for update, and keep automatic updates enabled.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.