EUVD-2026-50700
GHSA-xfq5-gfch-m94w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryServe malicious WebGL/ANGLE content
-
ExploitTrigger use-after-free in ANGLE
-
ExecutionCorrupt renderer memory
-
PersistAttempt sandbox escape
-
ImpactGain code influence beyond renderer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled HTML page in a vulnerable Chrome build (prior to 151.0.7922.72) that exercises the ANGLE graphics/WebGL path - user interaction (UI:R) is mandatory, so there is no zero-click or server-side trigger. The condition is a crafted HTML page reaching ANGLE's rendering pipeline; hardware acceleration/WebGL being active is the enabling feature, so environments with GPU acceleration or WebGL disabled substantially reduce exposure. No authentication is required (PR:N), but exploitation is limited by the need for user interaction, the Medium/partial technical impact, and the fact that a full sandbox escape is described as potential rather than guaranteed. |
| Impact | The signals here are broadly consistent and point to a real-but-not-emergency issue. CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a network-reachable, low-complexity, unauthenticated bug that nonetheless requires user interaction (visiting a page) and yields only partial (Low) confidentiality, integrity, and availability impact, with a scope change reflecting the sandbox-escape potential. CISA's SSVC framework aligns with this: Exploitation=none, Automatable=no, Technical Impact=partial - supporting a Track/scheduled-patch rather than act-now posture. EPSS is low at 0.21% (11th percentile), it is not listed in CISA KEV, and no public exploit or POC has been identified, so this is not currently under active or widespread exploitation. Note the tags include 'Denial Of Service,' which understates the vendor's own framing of a potential sandbox escape - treat the memory-corruption/sandbox-escape characterization as authoritative over the DoS tag. Overall this is a legitimate memory-corruption flaw worth patching in the normal browser update cycle rather than a high-urgency crisis. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content and lures a victim to open it (via link, ad, or compromised site). When Chrome's ANGLE component processes the content, the use-after-free is triggered, corrupting memory in a way that could be chained toward escaping the renderer sandbox. No public exploit or POC is currently identified, and success depends on the victim visiting the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.
RemediationAI
Vendor-released patch: Google Chrome 151.0.7922.72 - upgrade Chrome desktop to 151.0.7922.72 or later, then fully restart the browser to load the new build, as documented in the Chrome Stable Channel update advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed fleets, ensure automatic updates are enabled and force a relaunch to guarantee the fix is applied, since Chrome only completes the update on restart. If patching must be delayed, the practical interim control is to disable hardware-accelerated graphics / WebGL exposure - for example turning off 'Use graphics acceleration when available' or restricting WebGL via enterprise policy - which reduces the untrusted attack surface into ANGLE at the cost of degraded rendering performance for graphics-heavy sites; combine with cautious browsing to avoid untrusted pages. Downstream Chromium-based browsers should be updated to the release that incorporates the equivalent ANGLE fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls onto the host platform's native graphics APIs (Direct3D, Metal, Vulkan, OpenGL). Because WebGL content is driven directly by untrusted web pages, ANGLE processes attacker-influenced rendering commands inside the GPU/renderer process. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains reachable, and subsequent use of that stale pointer corrupts memory. In a browser context this memory corruption in ANGLE can be leveraged toward a sandbox escape, meaning code influence beyond the confines of the sandboxed renderer. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop application across versions below the fixed build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote crafted page needs no auth (PR:N) but requires the victim to visit it (UI:R); sandbox-escape potential justifies S:C with partial (Low) C/I/A impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's ANGLE graphics component contains a sandbox escape vulnerability (CVE-2026-17750) affecting all desktop systems running versions prior to 151.0.7922.72, where remote attackers can craft malicious webpages to potentially execute code outside the browser's security boundary. While current exploitation risk remains low (0.2% EPSS, no active attacks detected), a vendor patch is already available, requiring only standard update deployment across the desktop fleet.
Apply vendor patch (Chrome 151.0.7922.72 or later).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB