EUVD-2026-50827
GHSA-h6fh-j6x4-3pq7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise renderer via prior bug
-
ExploitSend malicious graphics input to ANGLE
-
ExecutionTrigger out-of-bounds read/corruption
-
PersistEscape sandbox to browser process
-
ImpactFull compromise of browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process - this is a second-stage sandbox-escape bug, not a standalone entry point. From that position, the attacker delivers crafted graphics/HTML input through the ANGLE component to trigger the flaw. Limiting factors: it applies specifically to the macOS build of Chrome before 151.0.7922.72; it depends on a prior renderer exploit (raising overall chain complexity); UI:R means the victim must load attacker-controlled content; and SSVC rates it not automatable, indicating it is not suited to mass, wormable exploitation. |
| Impact | The signals are mixed and worth weighing carefully. CVSS 3.1 scores this 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - the Critical rating is driven almost entirely by the Scope change (S:C) inherent to a sandbox escape, not by ease of standalone exploitation. Crucially, the description states the attacker must have ALREADY compromised the renderer process, which the PR:N metric does not capture; this is a second-stage bug in an exploit chain, not a single-shot RCE. That aligns with SSVC (Exploitation: none, Automatable: no, Technical Impact: total) and the low EPSS (0.29%, 21st percentile): high potential impact but no evidence of active or automatable exploitation. Net: patch promptly as part of normal Chrome update cadence, but this is not a drop-everything emergency absent a paired renderer RCE. Note the apparent tension - CVSS models a network/unauthenticated vector while the description implies a chained prerequisite; treat the raw 9.6 as impact-weighted rather than a measure of standalone attacker effort. |
| Exploit ScenarioDerived | A victim visits a malicious or compromised web page that first exploits a separate renderer bug to gain code execution inside Chrome's sandboxed renderer, then feeds crafted graphics input through ANGLE to trigger the out-of-bounds condition and escape the sandbox into the browser process. Because scope changes on success, the attacker gains control at a higher privilege level than the renderer. No public exploit is identified at time of analysis, and SSVC assesses exploitation as not automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so verify the running version under chrome://settings/help and relaunch to apply. There is no separate documented workaround, but because exploitation requires a first-stage renderer compromise, meaningful compensating controls until patching completes include reducing renderer attack surface - enforce Chrome's Enhanced/Strict Site Isolation (default) and disable unnecessary WebGL/hardware acceleration via enterprise policy (chrome://settings, HardwareAccelerationModeEnabled=false), accepting the trade-off of degraded graphics performance for WebGL-dependent sites. Managed fleets should push the updated version through MDM/enterprise policy to guarantee coverage rather than relying on per-user auto-update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in ANGLE (Almost Native Graphics Layer Engine), Chrome's abstraction library that translates WebGL/OpenGL ES calls onto native GPU backends - on macOS this maps to Metal/OpenGL. ANGLE runs at the boundary between the sandboxed renderer and the more-privileged GPU/browser process, so a memory-safety bug here is a classic sandbox-escape primitive. NVD classifies the root cause as CWE-125 (out-of-bounds read), while the input tags additionally reference Buffer Overflow and Information Disclosure, consistent with insufficient validation of untrusted input allowing reads (and potentially further corruption) outside intended buffer bounds. The only affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the macOS build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AV:N/UI:R for the malicious page, but AC:H because success requires a chained prior renderer compromise; S:C reflects the sandbox escape and C/I/A:H reflect total technical impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on macOS contains a critical sandbox escape vulnerability (CVE-2026-17701) that could allow an attacker to elevate from browser compromise to full system control. This breaks the last line of defense between untrusted web content and sensitive user data and systems. Chrome users on macOS-including employees accessing corporate resources-face the risk of undetectable system-level compromise if they encounter malicious websites.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB