CVE-2026-106419

Executive Summary

CVE-2026-106419 is a high-severity use-after-free (UAF) vulnerability in the ANGLE graphics rendering layer of Google Chrome on Android. It affects Chrome for Android versions prior to 155.0.8059.39 and can be triggered remotely by a victim visiting a crafted HTML page. Successful exploitation permits arbitrary code execution outside the browser sandbox under a CVSS 3.1 base score of 9.6, representing a critical risk for mobile enterprise users.

Technical Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the translation layer that maps OpenGL ES API calls to the underlying platform graphics API — on Android this is typically Vulkan or OpenGL ES via the platform graphics driver. ANGLE is a core Chromium component responsible for WebGL and hardware-accelerated canvas rendering. The flaw is classified as CWE-416: Use After Free, meaning the application references memory after it has been released. In practice, this involves a freed object inside the graphics pipeline — for example a texture, buffer, shader program, or internal object wrapper — whose pointer remains accessible to subsequent operations. Due to the crafted HTML page, JavaScript-driven WebGL calls can force the allocation and premature deallocation of such an object, and then trigger a code path that reuses the stale pointer.

The added severity here is the notation that exploitation results in code execution outside the sandbox. ANGLE executes inside the browser's renderer process, which is normally sandboxed. The fact that this vulnerability is described as permitting code execution outside the sandbox indicates the freed object — or the corruption achieved via the UAF — grants a write primitive that crosses the process/privilege boundary, potentially through a compromised GPU process or privileged browser helper. This is characteristic of a graphics stack bug where the GPU process holds elevated handles or where the UAF provides an arbitrary read/write primitive enabling sandbox escape.

Attack surface: any web page rendered in Chrome for Android that reaches the hardware-accelerated graphics path. No user privileges are required (PR:N), no authentication is needed, but user interaction (UI:R) is required — the victim must open the malicious page.

Limited technical detail is available publicly: no specific function names, class names, or file paths have been disclosed. Chromium security severity is rated High. The vulnerability is unpatched according to patch-tracking sources, and no public PoC, exploit code, or Nuclei template exists as of this writing.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred at the vulnerability-class level consistent with the NVD description.

1. Reconnaissance / target identification. The attacker identifies a target population running Google Chrome for Android with a build older than 155.0.8059.39. Any Android device with Chrome that has not been updated to the fixed build is potentially exposed. No network-service discovery is needed; the target is reached through ordinary web browsing.

2. Triggering the flaw. The attacker hosts or injects a crafted HTML page containing inline JavaScript. When the victim opens that page in Chrome for Android, the JavaScript drives WebGL/ANGLE rendering operations that cause an ANGLE-managed object to be freed while a stale reference remains. A subsequent graphics operation reuses the freed memory. This is the CWE-416 use-after-free condition being triggered through the graphics render path. Insufficient public detail exists to name the specific ANGLE object or API call involved; the mechanism is described here only at the vulnerability-class level.

3. Execution method. The dangling reference yields memory corruption within the ANGLE/graphics code path. That corruption is shaped into a memory-manipulation primitive, which is then leveraged to place and execute attacker-controlled code. Per the NVD description the resulting code execution occurs outside the browser sandbox, distinguishing this from a plain renderer-compromise bug and elevating its severity.

4. Post-exploitation impact. Once code executes outside the sandbox, the attacker inherits the privileges of the compromised non-renderer process — potentially the GPU process or a privileged browser component — and can further pivot, establish persistence, or exfiltrate data. The successful outcome of arbitrary code execution at that privilege level, on a mobile device, is a full compromise of the affected browser context and potentially the device user's data.

Because no public exploit exists, exploitation in the wild cannot yet be confirmed; the risk is driven by weaponization potential and the severity rating, not by observed campaigns.

Impact Assessment

The CVSS 3.1 base score of 9.6 reflects: Network attack vector (AV:N) — exploitable remotely via a served web page; Low attack complexity (AC:L); No privileges required (PR:N); User interaction required (UI:R); Scope changed (S:C) — the vulnerable component (ANGLE/graphics/GPU process) is compromised and the attacker can affect resources beyond its original security authority (sandbox escape); High Confidentiality (C:H), Integrity (I:H), and Availability (A:H) impact.

Business impact: mobile enterprise fleets running unpatched Chrome for Android are exposed to a full-client compromise via ordinary user browsing activity. Blast radius includes any phone or tablet system where Chrome for Android has not been updated past 155.0.8059.39 — including BYOD and managed devices that access corporate web apps, SSO portals, and email links. Because UI:R means the attack requires the user to open a page, phishing and drive-by scenarios are realistic vectors. A successful sandbox escape turns a browser visit into device-level risk, so the effective organizational impact includes credential theft, session hijacking, and lateral movement into cloud/enterprise resources accessible from the mobile endpoint.

Detection Guidance

Sigma Rule

title: Chrome Android ANGLE Use-After-Free Exploitation Attempt (CVE-2026-106419)
id: 8f3c2a7e-6b41-4d92-9c1f-2ad0e5b7c413
status: experimental
description: Detects suspicious Chrome/Chromium renderer or GPU process crash behavior potentially associated with ANGLE use-after-free exploitation on Android.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106419
author: valtersit.com
logsource:
  product: android
  service: crash_report
detection:
  selection_proc:
    process.name|contains:
      - 'chrome'
      - 'com.android.chrome'
      - 'gpu_process'
  selection_fault:
    fault.class|contains:
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'use-after-free'
      - '0x27'   # heap-use-after-free ABORT marker
  condition: selection_proc and selection_fault
fields:
  - process.name
  - fault.class
  - fault.address
falsepositives:
  - Legitimate graphics driver crashes
level: high

YARA Rule

rule CVE_2026_106419_Chrome_ANGLE_UAF
{
    meta:
        description = "Detects use-after-free exploit artifacts targeting ANGLE in Chrome for Android (CVE-2026-106419)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106419"
        date = "2026-01-01"
        severity = "high"
    strings:
        $angle = "ANGLE" ascii wide
        $libegl = "libEGL" ascii wide nocase
        $libgles = "libGLESv2" ascii wide nocase
        $uaf = "use-after-free" ascii nocase
        $webgl = "getContext" ascii wide
        $webgl2 = "webgl2" ascii wide nocase
        $heap_free = { 5f 5a 4e 31 30 67 70 75 73 5f 62 61 73 65 }  // gp gpu base symbol hint
    condition:
        uint32be(0) == 0x7f454c46 and   // ELF binary
        filesize < 100MB and
        (3 of ($angle, $libegl, $libgles)) and
        ($webgl or $webgl2 or $uaf)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106419 Chrome Android ANGLE Use-After-Free Attempt (suspicious WebGL page)"; flow:to_client,established; http.header; content:"User-Agent"; nocase; content:"Android"; nocase; content:"Chrome/1"; nocase; pcre:"/Chrome\/(?:[0-9]{1,2}|1[0-4][0-9]|15[0-4])\.[0-9]+\.[0-9]+\.[0-9]+/H"; http.response_body; content:"getContext"; nocase; content:"webgl"; nocase; distance:0; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:2026106419; rev:1; metadata:affected_product "Google Chrome Android", cve "CVE-2026-106419", created_at "2026_01_01";)

Elastic Detection

process where event.type == "start" and
  process.name : ("chrome", "com.android.chrome") and
  process.parent.name : ("init", "zygote", "gpu_process") and
  process.command_line : ("*--type=gpu-process*" or "*--type=renderer*") and
  process.args : ("*angle*" or "*webgl*")

Splunk SPL Query

index=android_logs OR index=chrome_crash
| search ("com.android.chrome" OR process_name="chrome")
| search ("FATAL EXCEPTION" OR "SIGSEGV" OR "SIGABRT" OR "use-after-free")
| regex _raw="(?i)(libEGL|libGLESv2|angle|gpu_process)"
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, fault_signature
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="chrome,android,cve-2026-106419,">
  <rule id="106419" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">chrome|com.android.chrome</field>
    <field name="fault.class">SIGSEGV|SIGABRT|use-after-free</field>
    <description>CVE-2026-106419: Possible Chrome for Android ANGLE use-after-free exploitation attempt (process crash)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED, per tracked sources; no vendor fix, workaround, or affected-version package data is available.

1. Immediate mitigations.

   • Where policy permits, restrict use of the Android Chrome build on managed devices, or require the browser to be updated to 155.0.8059.39 or later once available.
   • Enforce mobile device management (MDM) policies that block or harden the Chrome for Android WebGL path where feasible — for example via managed configurations disabling hardware acceleration or untrusted content.
   • Deploy web filtering and network detection (see Suricata rule above) to reduce exposure to known malicious pages.
   • Treat the vulnerability as exploitable via ordinary browsing; reinforce phishing awareness for users on affected Android devices.

2. Patch / upgrade steps.

   • Update Chrome for Android to version 155.0.8059.39 or later as soon as it is published. Until the fixed build is confirmed, treat the device as unpatched.
   • Monitor the Chrome Releases blog and the Chromium security advisories for the release that addresses CVE-2026-106419.
   • For enterprise-managed devices, push the update through Google Play managed updates or an approved device management channel.

3. Long-term hardening.

   • Maintain an enforced minimum-version policy for mobile browsers on all endpoints that access corporate resources.
   • Integrate the SIGMA, YARA, Suricata, Elastic, Splunk, and Wazuh detections delivered in this report into SOC workflows.
   • Track CISA KEV and Chromium advisories for future ANGLE/graphics-stack vulnerabilities and accelerate patch SLAs for browser components with sandbox-escape potential.

References

1. NVD — CVE-2026-106419: https://nvd.nist.gov/vuln/detail/CVE-2026-106419
2. MITRE CWE-416 (Use After Free): https://cwe.mitre.org/data/definitions/416.html
3. Chromium Security Advisories / Chrome Releases blog: https://chromereleases.googleblog.com/
4. Google Chrome for Android release notes and Play Store changelog
5. FIRST EPSS — Not yet scored for CVE-2026-106419 (no value available at time of writing)

No confirmed threat-actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-106419 at this time; CISA KEV status is NO.