EUVD-2026-50817
GHSA-4c2c-vwch-6hm8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes malicious WebGL/graphics content
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionCorrupt adjacent renderer memory
-
ImpactEscape Chrome sandbox to higher privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on Windows at a version below 151.0.7922.72 and to actively load attacker-controlled content - the CVSS UI:R and the description's 'crafted HTML page' confirm user interaction (visiting/rendering a malicious page) is mandatory, so this is not a zero-click flaw. The vulnerable code path is ANGLE's graphics processing, implying the page must exercise WebGL/graphics functionality to reach the out-of-bounds write. No authentication is required (PR:N), and the platform is limited to Windows. Limiting factors: the single required user interaction, the Windows-only scope, and the description's cautious 'potentially perform a sandbox escape' wording indicating exploitation is not guaranteed; environments that disable WebGL/hardware acceleration further reduce reachability. |
| Impact | Signals are partially conflicting and warrant nuance. The CVSS 3.1 base score is 9.6 (Critical) driven by AV:N/AC:L/PR:N with a scope change (S:C) and full C:H/I:H/A:H impact, and it is tempered only by UI:R (the victim must visit a page). Against that, EPSS is low at 0.29% (21st percentile) and there is no KEV listing and no public exploit identified - so despite the high CVSS this is not evidence of imminent mass exploitation. The description itself hedges ('potentially perform a sandbox escape'), indicating the OOB write is a memory-corruption primitive whose weaponization into a reliable escape is non-trivial. Net: this is a genuinely serious browser memory-corruption bug that should be patched promptly given Chrome's ubiquity and the low bar of a single malicious page, but current real-world exploitation risk is unproven rather than active. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted WebGL/graphics content and lures a Windows Chrome user to open it (e.g., via phishing link or malvertising). When the page's content is processed by ANGLE, it triggers the out-of-bounds write to corrupt memory and attempts to escape the renderer sandbox toward code execution in a higher-privileged context. No public exploit is identified at time of analysis, and success depends on the victim actually visiting the page (UI:R) and on reliably weaponizing the memory-corruption primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Stable channel; the fix is confirmed available per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Trigger 'Help > About Google Chrome' to force the update and fully relaunch the browser so the new binary loads, then verify enterprise fleets via your management console/GPO. Until patched, the practical compensating control is to reduce the attack surface of the vulnerable ANGLE/WebGL path - for example disabling hardware acceleration or restricting WebGL (chrome://flags or enterprise policies), which lowers exposure but degrades graphics performance and may break WebGL-dependent sites; avoid untrusted sites and consider strict site isolation and content filtering. Chromium-based browsers should be updated to builds that incorporate the equivalent ANGLE fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL/OpenGL ES calls onto native backends such as Direct3D on Windows, making it directly reachable from untrusted web content via JavaScript/WebGL. The root cause is CWE-787 (Out-of-bounds Write): a memory-corruption condition where the code writes past the bounds of an allocated buffer, typically due to an unchecked index or length in graphics command/geometry processing. Because ANGLE runs in a context bridging the sandboxed renderer and lower-level graphics drivers, a controlled OOB write here is a classic primitive for corrupting adjacent memory and pivoting toward a sandbox escape. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, limited to the Windows platform per the description.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote via crafted page with no auth but required user interaction; AC:H reflects the non-trivial memory-corruption exploitation and 'potential' escape, with scope change and full impact on success.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
A critical vulnerability in Google Chrome for Windows (CVE-2026-17691) enables attackers to gain system-level access through malicious webpages, affecting all unpatched Windows endpoints across your organization. Leadership should prioritize this because the vulnerability fundamentally breaks browser isolation-a primary endpoint security control-creating backdoor potential for attackers. Risk is manageable: exploitation is currently low (EPSS 0.3%), and patching Chrome 151.0.7922.72 is straightforward, making this a 24-48 hour remediation priority.
Apply vendor patch: Chrome 151.0.7922.72 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB