EUVD-2026-50808
GHSA-9vq8-3c74-6rf6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered via a crafted page (AV:N, UI:R) but requires a prior renderer compromise plus overflow grooming, so AC:H; the sandbox escape crosses a trust boundary (S:C) with full host impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction library that translates OpenGL ES / WebGL calls into the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). The root cause is CWE-190, an integer overflow: an arithmetic operation on attacker-influenced values such as buffer sizes or vertex/texture dimensions supplied through WebGL wraps around, producing an undersized allocation or out-of-bounds index that corrupts memory. Because ANGLE code runs at the boundary between the sandboxed renderer and the more privileged GPU process, memory corruption here can be leveraged to escape the renderer sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*, and the tags (Integer Overflow, Buffer Overflow) confirm the overflow manifests as a buffer memory-safety violation.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade to 151.0.7922.72 or later on all desktop platforms, which is the primary and complete fix (see the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome typically auto-updates on relaunch, so ensure endpoints are restarted to apply the update and verify the running build via chrome://version. Where immediate patching is not possible, compensating controls include disabling hardware-accelerated GPU/WebGL by turning off 'Use graphics acceleration when available' in chrome://settings or via the --disable-gpu / --disable-webgl launch flags, or blocking WebGL through enterprise policy, which reduces reachability of the vulnerable ANGLE code path; the trade-off is degraded rendering performance and broken WebGL-dependent web applications. Because exploitation also requires a prior renderer compromise, keeping Chrome's site isolation enabled and restricting installation of untrusted extensions further limits the practical attack chain.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today