Chromium CVE-2026-118329: Improper ANGLE Input Validation Patching Guidance for Edge and Chrome

What happened

CVE‑2026‑118329 identifies an improper input‑validation bug in ANGLE, the graphics abstraction layer that translates WebGL and Direct3D calls into native rendering APIs. The flaw allows an attacker to supply malformed data that bypasses bounds checks, potentially leading to memory corruption and arbitrary code execution within the browser process.

The vulnerability was discovered by the Chrome security team and assigned a CVE identifier in early 2026. Microsoft Edge, which is built on Chromium, inherits the same ANGLE code base and therefore shares the same vulnerability surface. The issue was addressed in the Chrome 120 and Edge 120 releases, which include stricter validation and bounds checks for ANGLE input streams.

Who is affected

All users of Google Chrome and Microsoft Edge running versions prior to the 120 update are potentially exposed. This includes desktop, mobile, and embedded Chromium‑based browsers that rely on ANGLE for graphics rendering. Any organization that deploys legacy browser versions on endpoints, or that uses Chromium‑based applications such as Electron, may also be impacted if those applications ship with an unpatched ANGLE component.

System administrators managing corporate networks with endpoints that run unpatched browsers, or that host web applications embedding Chromium, should assess the presence of the vulnerable component. The vulnerability does not affect browsers that have already applied the latest security patches or those that do not use ANGLE (e.g., legacy WebKit‑based browsers).

Impact

The flaw can be leveraged to achieve remote code execution (RCE) from a malicious web page or a compromised site that serves crafted ANGLE data. Successful exploitation would allow an attacker to run arbitrary code with the privileges of the browser process, potentially escalating to higher privileges on the host system. In an enterprise setting, this could facilitate credential theft, data exfiltration, or lateral movement across the network.

Because ANGLE operates within the browser sandbox, exploitation typically requires the user to visit a malicious site or open a malicious file that triggers the vulnerable code path. Once the sandbox is bypassed, the attacker can compromise the host machine, install persistence mechanisms, or pivot to internal resources. The high severity of the vulnerability underscores the need for rapid remediation.

Exposure

Attackers can trigger the vulnerability by delivering specially crafted ANGLE input to the browser. This is most commonly achieved through a drive‑by attack where a user visits a compromised website that serves malicious WebGL or Direct3D content. Phishing campaigns that embed malicious scripts or exploit code in email attachments can also be used to deliver the payload.

The exposure surface is limited to browsers that process ANGLE data. Local file exploitation is unlikely unless the user opens a malicious file that is parsed by ANGLE. Network‑based attacks rely on the user’s interaction with the web content, making user awareness and safe browsing practices an additional line of defense.

What to do

Immediate remediation requires updating all affected browsers to the latest stable releases that contain the ANGLE patch. Microsoft Edge users should enable Windows Update or manually download the latest installer from the Microsoft website. Google Chrome users should allow the built‑in updater to install the newest version automatically.

In addition to updating, defenders should enforce a strict update policy, monitor for anomalous browser activity, and isolate vulnerable endpoints until the patch is applied. The following actions are recommended:

• Verify that Windows Update is enabled and set to automatically install Edge updates.
• Ensure Chrome’s auto‑update feature is active on all endpoints.
• Deploy group policy restrictions to block installation of older Chromium‑based browsers.
• Configure web filtering to block domains known to host malicious ANGLE payloads.
• Monitor system logs for ANGLE‑related errors or crashes that may indicate exploitation attempts.
• Conduct an audit of all endpoints to confirm that no outdated browser versions remain.
• Apply vendor patches for Electron or other Chromium‑based applications that may embed ANGLE.

What to watch

After patching, maintain vigilance for new indicators of compromise (IOCs) related to ANGLE exploitation. Threat actors may develop new exploit code or leverage the vulnerability in novel ways, such as through malicious advertising networks or compromised content delivery networks.

Defenders should monitor for signs of exploitation, including unexpected browser crashes, anomalous memory access patterns, or unusual outbound connections originating from the browser process. Staying informed through threat intelligence feeds and CVE updates will help identify emerging risks.

• New exploit code posted on dark‑web forums or exploit‑sharing sites.
• Phishing campaigns that embed malicious ANGLE payloads in attachments or links.
• Suspicious outbound traffic from browsers to known malicious IP addresses.
• Unexpected browser crashes reported by users or detected by EDR solutions.
• Updates to the CVE database indicating active exploitation or zero‑day activity.