EUVD-2026-50823
GHSA-g9r6-47g2-3cpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage drives malicious WebGL/ANGLE content
-
ExploitTrigger type confusion in ANGLE
-
ExecutionCorrupt GPU-process memory
-
PersistEscape renderer sandbox
-
ImpactExecute attacker code in privileged context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open a crafted HTML page in a vulnerable Chrome build (< 151.0.7922.72) that exercises the ANGLE graphics path (typically WebGL/GPU-backed content) - this is the UI:R limiting factor: there is no purely passive, zero-click vector implied. No authentication or prior privileges are needed (PR:N). Exploitation is further limited by dependence on ANGLE/GPU processing (mitigable by disabling hardware acceleration), and per CISA SSVC it is not automatable, meaning it hinges on luring individual users rather than mass, hands-off compromise. A full sandbox escape (S:C) as described is 'potential' and, as with most such bugs, likely needs a reliable memory-corruption primitive and may be chained with other flaws. |
| Impact | Signals conflict in an instructive way. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) is severe because it is network-reachable, low-complexity, unauthenticated, scope-changing (renderer-to-broader sandbox escape) with total confidentiality/integrity/availability impact - offset only by UI:R (the victim must visit a page). Against that, real-world urgency signals are muted: EPSS is just 0.31% (24th percentile), the SSVC framework reports Exploitation: none and Automatable: no (consistent with UI:R - drive-by is not fully automatable without victim navigation), and only Technical Impact: total is elevated. This is a genuinely high-severity memory-corruption bug but not currently evidenced as actively exploited; treat it as a standard-priority browser patch rather than an emergency, while noting browser sandbox escapes are frequently chained and historically become exploited after disclosure. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/shader content and lures a victim (via phishing link, malvertising, or a compromised site) to open it in an unpatched Chrome. The page triggers the ANGLE type confusion to corrupt memory and attempt escape from the renderer sandbox into the more-privileged GPU/browser process. No public proof-of-concept is identified at time of analysis, and the attack requires the victim to visit the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.
RemediationAI
Update Chrome to 151.0.7922.72 or later (Vendor-released patch: 151.0.7922.72); patch is available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome normally auto-updates, so verify via chrome://settings/help and relaunch to apply, and push the update through enterprise management (e.g. Chrome Browser Cloud Management / group policy) to fleet endpoints. Until the update is deployed, reduce exposure to untrusted web content; as a targeted mitigation you can disable GPU/hardware acceleration (chrome://settings - 'Use graphics acceleration when available', or the --disable-gpu flag) to shrink the ANGLE attack surface, at the cost of degraded rendering/video performance and battery life. Users of other Chromium-based browsers should apply their vendor's equivalent update once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL/OpenGL ES calls onto the host's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because it processes attacker-influenced GPU/shader content and runs partly in the more-privileged GPU process, memory-safety bugs here are a classic sandbox-escape surface. The root cause is CWE-843 Type Confusion: code interprets a memory object as an incompatible type, allowing out-of-bounds or otherwise corrupted access that can be steered toward code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome (all builds before the fixed release) across desktop platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); a sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17697) capable of compromising employee systems through malicious web pages. While no public exploits currently exist and the EPSS risk score is low at 0.3%, the vulnerability requires immediate patching due to its technical severity and the system-level access such attacks could achieve.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB