EUVD-2026-50760
GHSA-wwmx-jr76-9vv7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage drives malicious WebGL/graphics calls
-
ExploitTrigger use-after-free in ANGLE GPU process
-
ExecutionCorrupt freed-object memory
-
PersistEscape renderer/GPU sandbox
-
ImpactBroader code execution on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim running an unpatched Google Chrome (prior to 151.0.7922.72) on Windows to actively load attacker-controlled content - the description specifies a 'crafted HTML page,' so the concrete prerequisite is that the user navigates to or renders that page (CVSS UI:R). Because the bug is in ANGLE, the malicious page must exercise the vulnerable graphics/WebGL code path, meaning active hardware-accelerated graphics increases exploitability while disabling GPU acceleration limits reachability. Limiting factors: mandatory user interaction (a visit/render), the platform is specifically Windows, and the outcome is a 'potential' sandbox escape rather than a guaranteed one, indicating the escape likely needs to be chained with additional primitives. No authentication is required (PR:N, unauthenticated). |
| Impact | Signals are mixed and point to a real-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) reflects remote, low-complexity, unauthenticated reach but requires user interaction (visiting a page), and the scope change (S:C) captures the sandbox-escape potential - though individual C/I/A impacts are only Low. EPSS is low at 0.17% (7th percentile), the CVE is NOT on CISA KEV, and no POC is referenced, so exploitation is not confirmed. Google's own Chromium rating is Medium, consistent with a 'potential' sandbox escape rather than a demonstrated full break. Note the tags list 'Denial Of Service' alongside memory corruption, but the description emphasizes sandbox escape, so the DoS framing appears to be a generic UAF tag rather than the primary confirmed impact - treat the escape potential as the driving risk. Overall this is a patch-on-normal-cadence browser bug, not a drop-everything emergency, but browser ubiquity keeps it relevant. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted WebGL/graphics content and lures a Windows Chrome user to visit it via link, ad, or compromised site. Rendering the page triggers the use-after-free in ANGLE inside the GPU process, which the attacker manipulates to corrupt memory and potentially escape the sandbox toward broader code execution. No public exploit is identified at time of analysis, and the attack requires the victim to actually load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Chrome stable channel (Settings > About Chrome triggers the update; relaunch to apply), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the updated build through enterprise patch management and force a browser relaunch since the fix only takes effect after restart. As an interim compensating control before patching, you can disable hardware-accelerated graphics (Settings > System > 'Use graphics acceleration when available', or the --disable-gpu flag / equivalent enterprise policy) to reduce ANGLE attack surface - trade-off: this degrades WebGL, video, and rendering performance and may break graphics-heavy web apps, so it is only a short-term stopgap until the update is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in ANGLE (Almost Native Graphics Layer Engine), Chrome's abstraction layer that translates WebGL/OpenGL ES calls from web content into native graphics APIs - on Windows this is primarily Direct3D. ANGLE executes in the sandboxed GPU process, a well-known chaining target because a memory bug there can weaken or bypass renderer isolation. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains reachable, and subsequent access to that freed memory can be manipulated to corrupt state and influence control flow, here in the context of a graphics operation driven by attacker-controlled HTML/WebGL content.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote crafted page needs a victim visit (UI:R) but no auth (PR:N); ANGLE UAF enabling sandbox escape crosses a trust boundary (S:C) with limited demonstrated C/I/A impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Windows contains a use-after-free vulnerability in the ANGLE graphics layer (CVE-2026-17811, CVSS 7.1) that permits remote attackers to escape the browser sandbox and potentially achieve system-level compromise through a single malicious webpage. Windows-based Chrome users running versions prior to 151.0.7922.72 face privilege escalation risk; however, the vulnerability demonstrates minimal near-term exploitation probability with no public exploit evidence and low EPSS scoring (0.2%), enabling measured patch deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB