EUVD-2026-50802
GHSA-w4xq-p7f5-g2wm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger inappropriate implementation in ANGLE
-
ExecutionEscape renderer sandbox (scope change)
-
ImpactGain broader access on Android device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (as the description states) and then serves a crafted HTML page that exercises the vulnerable ANGLE code path to escape the sandbox; it also requires user interaction (UI:R), since the victim must load the attacker-controlled page, and applies specifically to Google Chrome on Android below 151.0.7922.72. The decisive limiting factor is the renderer-compromise prerequisite: this is not a standalone remote-unauthenticated bug despite CVSS PR:N, and is only useful as the second stage of an exploit chain, which materially lowers real-world exploitability relative to the 9.6 score. |
| Impact | The signals must be read together and they conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6) appears critical mainly because of the scope change (S:C) inherent to a sandbox escape, but PR:N conflicts with the description, which explicitly requires 'a remote attacker who had compromised the renderer process' - a real prerequisite CVSS does not model as a privilege, so the raw 9.6 overstates standalone exploitability; verify with vendor that this is a chain link, not a one-shot remote compromise. Supporting that, EPSS is only 0.29% (21st percentile), there is no CISA KEV listing, and no public exploit is identified, indicating no evidence of active or widespread exploitation. Realistically this is a high-value component of a multi-stage exploit chain (renderer RCE plus this escape) rather than an independently wormable issue; prioritization should be driven by the large Android Chrome footprint and the fact that a vendor patch already exists. |
| Exploit ScenarioDerived | An attacker first achieves code execution in Chrome's renderer (for example via a separate memory-corruption bug), then lures the victim to a crafted HTML page that drives malicious WebGL/graphics calls into ANGLE to escape the renderer sandbox and gain broader access on the Android device. No public exploit is identified at time of analysis, and the attack depends on chaining with a prior renderer compromise plus the victim opening attacker-controlled content, reflecting the network vector, low complexity, and required user interaction in the CVSS data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. There is no public exploit identified at time of analysis, and EPSS is low (0.29%, 21st percentile), consistent with a bug that only becomes useful after a prior renderer compromise.
RemediationAI
Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this ships through Google Play, so ensure automatic app updates are enabled and force updates on managed fleets via MDM. Because the bug requires a prior renderer compromise, keeping Chrome fully patched also raises the bar on the initial renderer RCE needed to reach it. Where WebGL/GPU acceleration is not required, disabling WebGL via enterprise policy or chrome://flags is a compensating control that shrinks the ANGLE attack surface, with the trade-off that it breaks WebGL-dependent sites and 3D content; no configuration workaround fully substitutes for the update, so patching is the primary action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in ANGLE (Almost Native Graphics Layer Engine), the abstraction library Chrome uses to translate WebGL/OpenGL ES calls onto the underlying platform graphics backend (on Android, typically OpenGL ES/Vulkan). ANGLE processes GPU-related work reachable from untrusted web content, making it a recurring target for renderer-to-host escapes. The root cause is classified as CWE-693 (Protection Mechanism Failure): an 'inappropriate implementation' in which a control meant to contain untrusted rendering work fails to fully enforce its boundary, letting a compromised renderer reach beyond the sandbox. The single CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome application, with the specific exposure being the Android build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted page delivered over the network (AV:N) with victim page-load (UI:R); the sandbox escape yields a scope change (S:C) with full host impact; PR:N is retained per official scoring though a prior renderer compromise is required in practice.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Android contains a sandbox escape vulnerability in the ANGLE graphics layer (CVE-2026-17676, CVSS 9.6) that could allow an attacker who has already compromised the renderer process to gain broader device-level access. This affects Chrome versions prior to 151.0.7922.72 and undermines the isolation protections that contain potential browser exploits on Android devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB