EUVD-2026-41184
GHSA-c37c-5whm-7pm5
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via crafted page (AV:N) with user interaction (UI:R); high complexity and renderer-compromise precondition (AC:H); scope change from sandbox escape (S:C) with total GPU-process impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.46) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. This is an out-of-bounds write (CWE-787) rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as 'none', though the technical impact is rated 'total'.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's abstraction layer that translates OpenGL ES / WebGL API calls into the platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). Because it processes untrusted GPU commands originating from web content, it is a frequent target for memory-safety bugs. The root cause here is CWE-787 (Out-of-bounds Write): attacker-controlled data causes a write past the bounds of an allocated buffer, corrupting adjacent memory. Since ANGLE code executes in the GPU process, which sits at a higher privilege boundary than the sandboxed renderer, corrupting its memory provides a path to escape the renderer sandbox. The affected component is captured by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: 150.0.7871.46 - update Google Chrome to 150.0.7871.46 or later via the Chrome Stable channel and relaunch the browser to apply it (Chrome auto-updates, but a restart is required to complete). Enterprises managing Chrome via policy should confirm the update has propagated to all endpoints and force a relaunch where updates are pending. See the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and issue tracker https://issues.chromium.org/issues/513010645. Users of Chromium-based browsers should update to the release that incorporates the corresponding ANGLE fix. As an interim compensating control before patching, disabling hardware-accelerated GPU rendering (chrome://settings, 'Use graphics acceleration when available' off, or the --disable-gpu flag) reduces exposure of the ANGLE/GPU code path, at the cost of degraded rendering performance and broken WebGL/GPU-dependent sites; this is only a partial mitigation and not a substitute for the patch.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today