CVE-2026-0908CWE-416

Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

High · published January 20, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

⚡ A crafty HTML page could expose your Chrome browser to heap corruption! With an ‘use after free’ bug in ANGLE, it’s like a delivery driver dropping packages just as you open the door. 🚪💥 Think of this vulnerability as a waiter at a restaurant who forgets to clear away your finished plates. If they keep serving you new dishes on a table full of leftovers, it can lead to some chaotic mess and potential mishaps! If an attacker gets crafty enough, they could exploit this issue to manipulate memory and potentially crash your browser, or worse, execute unwanted code. While it’s not currently known to be exploited, having your browser misbehave could be absolutely frustrating!

Put simply

Think of this vulnerability as a waiter at a restaurant who forgets to clear away your finished plates. If they keep serving you new dishes on a table full of leftovers, it can lead to some chaotic mess and potential mishaps! This vulnerability in ANGLE (a graphics engine) involves an 'use after free' issue that allows memory to be incorrectly accessed after it has been released, which can lead to heap corruption in Google Chrome versions earlier than 144.0.7559.59.

What to do

If an attacker gets crafty enough, they could exploit this issue to manipulate memory and potentially crash your browser, or worse, execute unwanted code. While it’s not currently known to be exploited, having your browser misbehave could be absolutely frustrating! To protect yourself, ensure your Chrome browser is updated to version 144.0.7559.59 or later. Regularly check for updates and apply them promptly to mitigate risks. Staying proactive is key! You've got this! Stay safe by keeping your browser updated, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.6th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-20T04:14Z
EPSS history
Timeline
  • 20 JAN 04:14Z
    Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5