CVE-2026-3536: 
vulnerability analysis and mitigation

CVE-2026-3536 is a critical integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome. It affects all Google Chrome versions prior to 145.0.7632.159 and Microsoft Edge (Chromium-based) versions prior to the equivalent patched release. The vulnerability was reported by researcher "cinzinga" on 2026-02-18 and publicly disclosed on 2026-03-03 when Google released Chrome 145.0.7632.159/160. It carries a CVSS v3.1 base score of 8.8 (High), and Google has rated it Critical in terms of Chromium security severity (Chrome Releases, Microsoft MSRC).

The root cause is an integer overflow (CWE-190) in ANGLE, Chrome's cross-platform OpenGL ES implementation used for hardware-accelerated graphics rendering. When processing specially crafted graphics-related content in an HTML page, an arithmetic operation on an integer value wraps around its maximum boundary, leading to an out-of-bounds memory access condition. Exploitation requires user interaction — specifically, a victim visiting a malicious HTML page — but no authentication or elevated privileges are needed. The Chromium bug tracker references issue 485622239, though full technical details remain restricted pending broad user adoption of the patch (Chrome Releases).

Successful exploitation could allow a remote attacker to perform out-of-bounds memory reads or writes, potentially leading to arbitrary code execution within the browser's renderer process, information disclosure, or denial of service. Because the vulnerability resides in the graphics rendering engine (ANGLE), it is reachable through any web content that triggers GPU-accelerated rendering, making the attack surface broad. Depending on sandbox escape capabilities, an attacker could potentially escalate beyond the renderer sandbox to affect the underlying host system (Chrome Releases, Feedly).

1. Reconnaissance: Identify targets running unpatched Google Chrome (versions prior to 145.0.7632.159) or Microsoft Edge (Chromium-based) on Windows, macOS, or Linux.
2. Craft malicious HTML page: Develop an HTML page containing WebGL or other GPU-accelerated content that triggers ANGLE's integer overflow — for example, by supplying carefully sized buffer or texture parameters that cause an arithmetic wraparound in ANGLE's internal calculations.
3. Deliver the payload: Host the malicious page on an attacker-controlled server and lure the victim to visit it via phishing, malvertising, or a compromised website. No authentication or special browser permissions are required.
4. Trigger the overflow: When the victim's browser renders the page, ANGLE processes the crafted graphics data, causing an integer overflow that results in an out-of-bounds memory access.
5. Achieve code execution or information disclosure: Depending on the specific memory layout, the attacker may read sensitive memory contents or corrupt memory to redirect execution flow, potentially achieving code execution within the renderer process and, with a sandbox escape, on the host system.

• Network: Unexpected outbound connections from the browser process to unknown external IPs following visits to unfamiliar or suspicious websites; unusual DNS lookups initiated by the browser process.
• Process: Browser renderer process (chrome.exe, msedge.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe, sh, bash) or crashing repeatedly with access violation errors.
• Logs: Browser crash reports or minidumps referencing ANGLE or GPU process components; Windows Event Logs showing application crashes in chrome.exe or msedge.exe with faulting module paths pointing to ANGLE DLLs (e.g., libGLESv2.dll).
• File System: Unexpected files written to the user's temp directory or browser profile directory following a browser session; new scheduled tasks or startup entries created by the browser user account.

Google has released Chrome 145.0.7632.159 (Linux) and 145.0.7632.159/160 (Windows/Mac) which addresses this vulnerability. Microsoft has also released a corresponding patch for Edge (Chromium-based). Users and organizations should immediately update Chrome and Edge to the latest available versions and ensure automatic updates are enabled. As a temporary workaround prior to patching, users should avoid visiting untrusted websites and consider disabling hardware acceleration in browser settings (Settings → System → Use hardware acceleration when available), though this may impact performance. Linux distributions including Debian, Fedora, and openSUSE have also released updated Chromium packages (Chrome Releases, Microsoft MSRC).

The vulnerability was part of a broader Chrome emergency update that patched 10 security issues, including three rated Critical, which drew significant media attention. Coverage appeared in Forbes, PCWorld, Heise, BleepingComputer, CyberSecurityNews, GBHackers, and SecurityOnline, with many outlets emphasizing the urgency of updating Chrome promptly (Forbes, SecurityOnline). The SANS ISC also published a diary entry covering the update. The $33,000 bug bounty awarded to the reporter was noted as indicative of the vulnerability's severity. Microsoft's March 2026 Patch Tuesday coverage also referenced this CVE in the context of Edge updates.