EUVD-2026-50804
GHSA-h6gj-q2pj-9v5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate exploit
-
DeliveryServe crafted HTML with malformed WebGL calls
-
ExploitTrigger out-of-bounds read in ANGLE
-
ExecutionLeak GPU-process memory to defeat ASLR
-
ImpactEscape browser sandbox onto host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is an explicit, concrete precondition stated in the CVE, not a default drive-by scenario; the OOB read in ANGLE is then reached via a crafted HTML page that the compromised renderer processes. Practical limiting factors: the attacker needs a prior renderer-compromise primitive (typically another 0-day/n-day), the victim must load the malicious content (UI:R user interaction), and only Chrome builds before 151.0.7922.72 are vulnerable. This is therefore a chain-dependent sandbox-escape component rather than standalone unauthenticated RCE against default configurations. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects the classic Chrome scoring model where a malicious web page reached via user navigation is treated as network, low-complexity, no-privileges with user interaction. However, this contradicts the description, which explicitly states the attacker must have ALREADY compromised the renderer process - a substantial precondition the base CVSS score does not capture, so the raw 8.8 overstates standalone risk. EPSS is low at 0.29% (21st percentile), it is NOT in CISA KEV, and no POC is referenced, so all real-world-exploitation signals are muted. SSVC-style reading: exploitation = none observed, technical impact = total (sandbox escape), automatable = no (requires prior renderer compromise). Net assessment: a genuine chain-enabling bug worth patching on Chrome's normal cadence, but not an emergency zero-day; its danger is realized only when paired with a separate renderer exploit. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer vulnerability to gain code execution inside a sandboxed Chrome renderer, then serves or navigates that renderer to a crafted HTML page issuing malformed WebGL/graphics calls that trigger the ANGLE out-of-bounds read. The leaked GPU-process memory is used to defeat ASLR and, combined with further primitives, to break out of the sandbox onto the host. No public POC is referenced for this specific CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most installs auto-update, so verify via chrome://settings/help and relaunch to apply. Users of Chromium-based browsers should install their vendor's build incorporating the equivalent Chromium version once available. As an interim compensating control before patching, restrict WebGL/GPU attack surface - for example disable hardware acceleration (chrome://settings, 'Use graphics acceleration when available') or disable WebGL, which reduces the ANGLE surface but degrades graphics-heavy site performance and 3D/canvas functionality. Enterprises can enforce update rollout via Chrome Browser Cloud Management / group policy to guarantee the fixed version is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that maps WebGL/OpenGL ES calls onto the host platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). It runs in the GPU process and processes attacker-influenceable graphics commands, making it a recurring sandbox-escape surface. The root cause is CWE-125 (Out-of-bounds Read): ANGLE reads memory outside the bounds of an allocated buffer, likely due to insufficient validation of shader or draw-call parameters passed from the renderer. Such a read can leak adjacent GPU-process memory (pointers, heap layout) that undermines ASLR and, combined with other primitives, aids escaping the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires prior renderer compromise (PR:L) and complex chaining (AC:H); successful sandbox escape crosses a trust boundary (S:C) with high C/I/A impact on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a graphics layer flaw that allows attackers who have already compromised a user's browser to escape the browser sandbox and execute system-level code. While this vulnerability requires an initial breach to be useful, successful exploitation transforms a contained browser compromise into full system access, significantly increasing the impact of malware infections or targeted attacks. Organizations using Chrome should deploy the patch immediately to prevent this post-compromise escalation vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB