EUVD-2026-50830
GHSA-r445-3fv9-v4hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML page
-
ExploitIssue malicious ANGLE GPU calls
-
ExecutionTrigger use-after-free on freed object
-
PersistCorrupt memory across sandbox boundary
-
ImpactEscape sandbox to browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process - this is a sandbox-escape/second-stage bug, not a standalone unauthenticated entry point, despite the PR:N in the CVSS vector. Delivery is via a crafted HTML page that exercises ANGLE's GPU translation paths, and UI:R indicates the victim must load/interact with attacker-controlled web content. Limiting factors: the required prior renderer compromise (a full separate exploit), user interaction to visit the malicious page, running Chrome older than 151.0.7922.72, and GPU/ANGLE code paths being reachable (disabling GPU acceleration reduces exposure). |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields 9.6, driven by network vector, scope change (sandbox escape), and full CHIA impact - but this rating is in tension with the description, which explicitly requires an attacker to have ALREADY compromised the renderer process. That renderer compromise is effectively a privilege prerequisite the PR:N metric does not capture, so this is realistically the second stage of an exploit chain rather than a single unauthenticated shot. Corroborating signals point to lower immediate urgency: EPSS is only 0.29% (21st percentile), SSVC reports Exploitation=none and Automatable=no, and there is no KEV listing and no public exploit. Technical Impact=total and Scope=Changed confirm that IF chained, the consequence (full sandbox escape) is severe. Net: high theoretical severity, but real-world priority is moderate and gated on a separate renderer bug - patch promptly but this is not an active-exploitation emergency based on available data. |
| Exploit ScenarioDerived | An attacker first compromises Chrome's renderer via a separate flaw (e.g., a V8 or DOM bug), then serves a crafted HTML page that drives malicious WebGL/GPU calls into ANGLE to trigger the use-after-free and pivot out of the sandbox into higher-privileged browser context. Because AV:N/AC:L applies once the renderer stage is achieved, the escape itself is low-complexity, but no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later, per the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome's auto-update will apply this on relaunch, so ensure users fully restart the browser to load the new binary. As an interim compensating control before updating, you can reduce the attack surface by disabling hardware/GPU acceleration (chrome://settings 'Use graphics acceleration when available' off, or the --disable-gpu / disable-accelerated-2d-canvas flags), which limits the ANGLE code paths reachable from web content - with the trade-off of degraded rendering performance and potential breakage of WebGL/GPU-dependent sites. Enterprises can also enforce update via the ChromeVersion/relaunch-notification management policies to guarantee the fixed build is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in ANGLE (Almost Native Graphics Layer Engine), the translation layer Chromium uses to map WebGL/OpenGL ES calls onto the host platform's native graphics backend (Direct3D, Metal, Vulkan, or OpenGL). Because ANGLE handles GPU-facing commands originating from untrusted web content, memory-safety bugs here are prime sandbox-escape primitives. The root cause is CWE-416 (use-after-free): a heap object is freed while a dangling reference remains, and subsequent access to that stale pointer allows an attacker to corrupt memory. The single affected product per CPE is cpe:2.3:a:google:chrome, exploited through GPU-related code paths reachable from a crafted HTML page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a prior renderer compromise (PR:H) and chaining a second bug plus a heap grooming primitive (AC:H); once achieved the sandbox escape changes scope with full impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that could allow attackers who have compromised the renderer process to break out of the browser sandbox and access the system. No public exploit identified at time of analysis. With a vendor patch available and low exploitation probability (0.3% EPSS), immediate patching is the organization's priority security action.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB