Vulnerability Spotlight: Use-after-free vulnerability in Google Chrome WebGL could lead to code execution

Summary: Cisco Talos discovered a use-after-free vulnerability in Google Chrome's WebGL component, specifically in ANGLE, the compatibility layer between OpenGL and Direct3D that Chrome uses on Windows. The flaw affects Chrome 81.0.4044.138 (Stable), 84.0.4136.5 (Dev) and 84.0.4143.7 (Canary), and an adversary could manipulate the browser's memory layout to gain control of the exploit and execute arbitrary code in the context of the browser process.
Bottom line: Arbitrary code execution inside the browser process means an attacker who lands this exploit operates with the browser's own privileges, and Talos worked with Google to ship an update - so the exposure sits with anyone still running the listed Chrome versions.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-8620
Related: Vulnerability Spotlight: Internet Systems Consortium BIND server DoS Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026