EUVD-2026-50801
GHSA-ww22-288f-wm8m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because reaching ANGLE requires a pre-existing renderer compromise plus a crafted page (UI:R); S:C and C/I/A:H reflect the sandbox escape into a higher-privilege process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction that translates WebGL/OpenGL ES calls onto native backends (Direct3D, Metal, Vulkan, desktop GL); it runs partly in the GPU process and interacts with the sandboxed renderer, making it a classic cross-privilege attack surface. The root cause is CWE-787 (Out-of-bounds Write) - memory-corrupting logic in ANGLE writes past an allocated buffer, corroborated by the 'Buffer Overflow, Memory Corruption' tags. Because ANGLE straddles the renderer/GPU boundary, an out-of-bounds write there can be leveraged to escape the renderer sandbox rather than merely crash a tab. Affected code is present in Chrome builds identified by CPE cpe:2.3:a:google:chrome (all versions prior to 151.0.7922.72).
RemediationAI
Vendor-released patch: update to Google Chrome 151.0.7922.72 or later on the Stable channel (Windows, macOS, Linux) as delivered in the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html - Chrome auto-updates, but confirm by restarting the browser and verifying the version, and push the update via enterprise management (GPO/MDM) to ensure endpoints relaunch. There is no separate configuration workaround for the flaw itself; because exploitation first requires renderer compromise, defense in depth for the initiating stage helps: keeping the whole browser current closes the renderer bugs needed to reach this primitive. As an interim hardening measure you can disable hardware acceleration (chrome://settings → System → 'Use graphics acceleration when available' off) to reduce ANGLE/GPU attack surface, at the cost of degraded rendering/video performance and higher CPU use; this is a mitigation, not a guaranteed fix. Downstream Chromium browsers should be updated to the build that incorporates the corresponding ANGLE fix once released.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today