Chrome 157 fixes 83 flaws, five critical use-after-frees
The Stable Channel update does not say these new flaws are being exploited; bug details may stay restricted.
68
CVE-2026-126858
Uninitialized resource in Chrome ANGLE on Windows
- CVSS 3.1
- 4.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An uninitialized resource in ANGLE, the graphics layer in Google Chrome on Windows before 157.0.8103.78, lets a remote attacker read memory outside the sandbox. The attacker needs the user to open a crafted HTML page. Successful use discloses memory that the browser sandbox is meant to keep out of reach. Only Windows Chrome builds older than that version are affected.
What to do: Update Google Chrome on Windows to 157.0.8103.78 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | Windows, prior to 157.0.8103.78 | 157.0.8103.78 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- Weakness
- CWE-908
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N