EUVD-2026-50843
GHSA-x743-xhcc-5xqf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage issues malicious WebGL/graphics calls
-
ExploitTrigger integer overflow in ANGLE
-
ExecutionCorrupt GPU/renderer memory
-
PersistEscape browser sandbox (scope change)
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome prior to 151.0.7922.72 to open or navigate to an attacker-controlled HTML page that drives the vulnerable ANGLE code path (WebGL/graphics rendering), consistent with UI:R in the CVSS vector - so user interaction is a hard prerequisite and there is no zero-click path. The overflow targets ANGLE specifically, so the graphics/WebGL rendering pipeline must be reachable (GPU acceleration/WebGL enabled, which is the default). Limiting factors: the description says the sandbox escape is only 'potentially' achievable, indicating it likely must be chained with a separate renderer-compromise bug rather than exploited standalone; SSVC lists Automatable: no, meaning it does not lend itself to reliable mass automation. |
| Impact | The signals are mixed and should be read together. The CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is elevated primarily by the scope change (S:C), reflecting the sandbox-escape nature - a renderer-boundary crossing - combined with high impact on all three properties; note that UI:R is required, since a victim must open or visit a crafted page. Against that high CVSS, EPSS is only 0.29% (21st percentile) and CISA SSVC records Exploitation: none and Automatable: no, with Technical Impact: total. These low-exploitation signals are consistent: the bug is described as allowing a sandbox escape 'potentially,' meaning it is likely one link in a multi-bug chain and not independently weaponizable, which lowers real-world probability despite the total technical impact. There is no KEV listing and no POC in the provided data. Net assessment: patch promptly given ubiquity and total impact, but this is not evidence of active mass exploitation - it is a high-severity, low-current-exploitation browser defense-in-depth fix. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted WebGL/graphics content and lures a victim to visit it (link, ad, or compromised site). When the page is rendered, the integer overflow in ANGLE is triggered inside the GPU/renderer path, corrupting memory to potentially escape the sandbox; realistically this is paired with a separate renderer RCE bug to achieve code execution outside the sandbox. No public POC is identified in the provided data, and user interaction (opening the page) is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 - update to this version or later via the stable channel and restart the browser to apply, verifying under chrome://settings/help. In managed environments, push the update through your enterprise deployment tooling and confirm auto-update is not disabled, since the fix is only effective after the relaunch that swaps the running ANGLE code. Users of other Chromium-based browsers should apply the corresponding vendor build once it rebases onto the fixed ANGLE. As an interim compensating control before patching, WebGL can be disabled or restricted (e.g. via enterprise policy or by hardening GPU acceleration), which removes the ANGLE attack surface but breaks legitimate 3D/WebGL and some canvas-accelerated sites; this is a meaningful usability trade-off and should be temporary. See the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls into the platform's native graphics API (Direct3D, Metal, Vulkan, or desktop OpenGL). It runs partly in the GPU process, which sits at a higher privilege boundary than the sandboxed renderer, so memory-safety bugs here are especially dangerous. The root cause is CWE-190 (Integer Overflow or Wraparound): an arithmetic operation - likely a size, offset, or buffer-length calculation for graphics data supplied via WebGL - wraps around, producing an undersized allocation or out-of-bounds access. The affected CPE is cpe:2.3:a:google:chrome across all versions below the fix, i.e. the desktop browser itself rather than a single OS build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via crafted page with UI:R; AC:H because reliable sandbox escape realistically requires chaining and precise heap grooming; S:C reflects the renderer-boundary crossing with total impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop (versions prior to 151.0.7922.72) contains a critical sandbox escape in the ANGLE graphics layer that could allow a malicious webpage to compromise system integrity. Although no active exploitation has been observed and a vendor patch is already available, this vulnerability represents a high-value component of advanced, multi-stage browser attacks. Organizations with significant Chrome desktop deployment should prioritize immediate patching to eliminate this attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB