EUVD-2026-50801
GHSA-ww22-288f-wm8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise renderer via chained bug
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionEscape renderer sandbox
-
ImpactExecute code in GPU/browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process - this is explicitly stated in the description and is the gating prerequisite; this bug is a sandbox-escape stage, not a first-contact vector. It further requires user interaction (UI:R): the victim must load a crafted HTML page in an affected Chrome build (< 151.0.7922.72). Limiting factors: the need for a pre-existing renderer foothold (typically a second, chained vulnerability) substantially constrains real-world exploitation, which is consistent with the low EPSS (0.21%), the absence of KEV listing, and no public exploit code. It affects default Chrome installations with standard ANGLE/GPU acceleration enabled, so no special non-default configuration is otherwise needed beyond the renderer-compromise precondition. |
| Impact | Signals are mixed and must be weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) looks alarming, but it materially understates the precondition stated in the description: the attacker must have ALREADY compromised the renderer process before this bug is reachable. This is a second-stage sandbox-escape primitive, not a standalone remote-code-execution entry point, so PR:N is technically defensible under Chromium's scoring convention but misleading in isolation - verify against the chained-exploit reality. Supporting the lower-urgency read: EPSS is only 0.21% (11th percentile), it is NOT on CISA KEV, there is no public exploit identified, SSVC-style exploitation status is 'none', and it was found internally by Google rather than seen in attacks. Countering that: it is browser-wide, memory-corruption based, network-reachable content (a web page) triggers the user-interaction, and sandbox escapes are prized as the pivot half of full Chrome exploit chains. Net: real but not emergency priority - patch on the normal expedited Chrome cadence; treat as higher priority for high-value targets where renderer bugs may be chained. |
| Exploit ScenarioDerived | A victim with an unpatched Chrome opens an attacker-controlled web page (UI:R) that first exploits a separate renderer vulnerability to gain code execution inside the sandboxed renderer, then uses this crafted content to trigger the out-of-bounds write in ANGLE and escape the sandbox into the more-privileged GPU/browser context. No public exploit is identified at time of analysis, and the scenario depends on chaining with a prior renderer compromise, raising the practical bar. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
RemediationAI
Vendor-released patch: update to Google Chrome 151.0.7922.72 or later on the Stable channel (Windows, macOS, Linux) as delivered in the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html - Chrome auto-updates, but confirm by restarting the browser and verifying the version, and push the update via enterprise management (GPO/MDM) to ensure endpoints relaunch. There is no separate configuration workaround for the flaw itself; because exploitation first requires renderer compromise, defense in depth for the initiating stage helps: keeping the whole browser current closes the renderer bugs needed to reach this primitive. As an interim hardening measure you can disable hardware acceleration (chrome://settings → System → 'Use graphics acceleration when available' off) to reduce ANGLE/GPU attack surface, at the cost of degraded rendering/video performance and higher CPU use; this is a mitigation, not a guaranteed fix. Downstream Chromium browsers should be updated to the build that incorporates the corresponding ANGLE fix once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction that translates WebGL/OpenGL ES calls onto native backends (Direct3D, Metal, Vulkan, desktop GL); it runs partly in the GPU process and interacts with the sandboxed renderer, making it a classic cross-privilege attack surface. The root cause is CWE-787 (Out-of-bounds Write) - memory-corrupting logic in ANGLE writes past an allocated buffer, corroborated by the 'Buffer Overflow, Memory Corruption' tags. Because ANGLE straddles the renderer/GPU boundary, an out-of-bounds write there can be leveraged to escape the renderer sandbox rather than merely crash a tab. Affected code is present in Chrome builds identified by CPE cpe:2.3:a:google:chrome (all versions prior to 151.0.7922.72).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because reaching ANGLE requires a pre-existing renderer compromise plus a crafted page (UI:R); S:C and C/I/A:H reflect the sandbox escape into a higher-privilege process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome contains a privilege-escalation vulnerability affecting browsers on Windows, macOS, and Linux systems that could grant attackers complete control over affected devices and their data if exploited following an initial renderer process compromise. No public exploits currently exist and exploitation probability is low (0.2% EPSS), but the potential impact to your organization's security posture and user data warrants immediate action. Vendor-released patch 151.0.7922.72 is available and must be deployed immediately across your managed environment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB