EUVD-2026-50813
GHSA-8m3j-qh2v-pc64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryCompromise renderer via separate bug
-
ExploitDeliver crafted WebGL/HTML to ANGLE
-
ExecutionTrigger type confusion in GPU process
-
PersistCorrupt memory to escape sandbox
-
ImpactExecute code at host privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (per the description) and then delivers a crafted HTML page that drives ANGLE into a type-confused state to escape the sandbox; user interaction is required in that the victim must load attacker-controlled web content (UI:R). Limiting factors: this is not a standalone unauthenticated exploit - it is a second-stage sandbox-escape primitive that presupposes a working renderer exploit, and it only affects Chrome builds before 151.0.7922.72. Attack complexity is rated low once the renderer is controlled, but the renderer-compromise prerequisite and the need for the user to visit a malicious page materially constrain real-world use to targeted exploit chains. |
| Impact | The CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects NVD/vendor scoring of the web-content attack surface with a scope change (renderer sandbox to host), but this must be read against the description, which explicitly states the attacker must have ALREADY compromised the renderer process. That is a meaningful precondition: this is a sandbox-escape LINK in an exploit chain, not a standalone unauthenticated RCE, so the PR:N/UI:R vector understates the real prerequisite. Corroborating this, EPSS is low (0.31%, 24th percentile) and there is no KEV entry and no public exploit identified, so despite the high CVSS this is not evidence of imminent mass exploitation. Net: patch on the normal Chrome cadence - high theoretical severity, but the requirement to first own the renderer and the absence of exploitation signals place it below any actively-exploited zero-day. Note the tension explicitly: CVSS PR:N conflicts with the description's 'compromised renderer' prerequisite - treat this as a chain component. |
| Exploit ScenarioDerived | An attacker first compromises Chrome's renderer through a separate bug when the victim visits a malicious or compromised web page, then serves crafted HTML/WebGL content that triggers the ANGLE type confusion to corrupt memory in the GPU/host process and escape the sandbox, gaining code execution at higher privilege. No public exploit is identified for this specific issue, and the attack requires the victim to load the page (UI:R) plus a pre-existing renderer compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel and restart the browser to apply it (see https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, push the update through your enterprise update policy / MDM and verify the running version afterward. If patching must be delayed, the practical compensating control is to reduce renderer-compromise exposure that this bug chains from: restrict browsing to trusted sites, deploy Chrome's site-isolation and enterprise hardening policies, and consider disabling GPU acceleration/WebGL for high-risk user groups (trade-off: degraded graphics/WebGL performance and possible breakage of GPU-dependent web apps). These are stopgaps only - the type-confusion fix requires the updated build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction that translates WebGL / OpenGL ES calls from web content into the host platform's native graphics API (Direct3D, Metal, or Vulkan). Because it processes attacker-influenceable GPU commands in a more privileged process than the renderer, memory-safety defects in ANGLE are a classic sandbox-escape surface. The root cause here is CWE-843 (Type Confusion): code interprets a memory object as one type when it is actually another, enabling out-of-bounds reads/writes and controllable memory corruption. The single affected CPE, cpe:2.3:a:google:chrome:*, confirms the Chrome desktop browser as the affected product; the tags (Memory Corruption, Information Disclosure) align with type-confusion primitives that leak and corrupt memory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Scored as a web-facing sandbox-escape chain component: network vector, user must load a page (UI:R), scope changes from renderer to host (S:C) with full C/I/A impact; PR:N retained per vendor scoring despite the renderer-compromise prerequisite.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome contains a critical vulnerability affecting versions before 151.0.7922.72 that allows sandbox escape, potentially enabling full system compromise for any user on an affected version. This poses enterprise-wide risk across all Chrome deployments. Immediate patching is required to restore security isolation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB