CVE-2026-0908: 
vulnerability analysis and mitigation

CVE-2026-0908 is a use-after-free vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome. It was reported by Glitchers BoB 14th on 2025-10-15 and publicly disclosed on January 13, 2026, as part of the Chrome 144 stable channel release. The vulnerability affects Google Chrome prior to version 144.0.7559.59 (Linux) and 144.0.7559.60 (Windows/Mac), as well as Microsoft Edge Chromium. It carries a CVSS v3.1 base score of 8.8 (High), assessed by CISA-ADP (Chrome Release, Microsoft MSRC).

The vulnerability is classified as CWE-416 (Use After Free) and resides in Chrome's ANGLE component, which provides a cross-platform OpenGL ES implementation over native graphics APIs. A use-after-free condition occurs when the browser accesses memory that has already been freed, potentially allowing an attacker to corrupt heap memory. Exploitation requires a remote attacker to craft a malicious HTML page that, when visited by a victim, triggers the memory corruption in the ANGLE graphics layer. The Chromium issue tracker entry (issue #452209503) is restricted pending broad user patching (Chrome Release).

Successful exploitation could allow a remote attacker to achieve arbitrary code execution within the browser's renderer process via heap corruption, with potential for high impact on confidentiality, integrity, and availability of the affected system. An attacker who successfully exploits this vulnerability could gain unauthorized access to sensitive data, modify system state, or cause a denial of service. While the Chromium team rated the severity as Low internally, CISA-ADP assessed the CVSS score at 8.8 (High), reflecting the potential for significant system compromise if sandbox escape is chained (Chrome Release, Feedly).

1. Reconnaissance: Identify targets running Google Chrome versions prior to 144.0.7559.59/60 or unpatched Microsoft Edge Chromium builds using browser fingerprinting or social engineering.
2. Craft malicious HTML page: Develop a specially crafted HTML page that triggers the use-after-free condition in Chrome's ANGLE graphics layer, likely through specific WebGL or graphics API calls that cause a freed memory object to be accessed.
3. Deliver payload: Host the malicious page on an attacker-controlled server and lure the victim to visit it via phishing email, malicious advertisement, or compromised website.
4. Trigger heap corruption: When the victim loads the page in a vulnerable Chrome or Edge browser, the ANGLE component processes the crafted graphics content, triggering the use-after-free and corrupting heap memory.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow, potentially achieving arbitrary code execution within the browser renderer process. Further sandbox escape would be required for full system compromise (Chrome Release).

• Network: Unexpected outbound connections from the browser process to unknown external IPs following visits to unfamiliar or suspicious websites; unusual WebGL or graphics-heavy page loads from untrusted domains.
• Process: Unusual child processes spawned by the Chrome or Edge browser process (e.g., cmd.exe, powershell.exe, bash, curl) that are not typical browser subprocesses.
• Logs: Browser crash reports or renderer process crashes associated with ANGLE or GPU-related components; entries in Chrome's crash reporter referencing heap corruption or use-after-free in ANGLE.
• File System: Unexpected files written to the user profile directory or temp directories by the browser process; new or modified browser extensions not installed by the user.

Google has released Chrome 144.0.7559.59 for Linux and 144.0.7559.60 for Windows and Mac, which address this vulnerability. Microsoft has also released a corresponding update for Edge Chromium. Users and administrators should immediately update Chrome and Edge to the latest available versions via the browser's built-in update mechanism or enterprise deployment tools. As a temporary workaround prior to patching, organizations should restrict user access to untrusted or unknown websites and consider deploying browser security extensions that provide additional protection against malicious web content (Chrome Release, Microsoft MSRC).

The Chrome 144 release, which includes the fix for CVE-2026-0908, received broad coverage from security news outlets including CyberSecurityNews, GBHackers, Forbes, and CyberPress, primarily in the context of the full set of 10 vulnerabilities patched in the release. The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Chrome 144 could allow arbitrary code execution. Palo Alto Networks also published a security advisory (PAN-SA-2026-0002) as part of their Chromium monthly vulnerability update for February 2026. Community discussion on platforms such as Mastodon and Bluesky was limited, reflecting the low-severity internal rating assigned by the Chrome team (CIS Advisory, Palo Alto Advisory).