EUVD-2026-65784
GHSA-rwq7-wq26-2qm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious WebGL content reaches ANGLE
-
ExploitTrigger out-of-bounds write in GPU process
-
ExecutionCorrupt memory to gain code execution
-
ImpactEscape sandbox onto Windows host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or navigate to an attacker-controlled crafted HTML page in Google Chrome on Windows (UI:R), and Chrome must be running a version prior to 152.0.7977.65 with GPU/ANGLE rendering active (the default). No authentication or prior privileges are needed (PR:N), and the attack is network-delivered (AV:N) with low complexity (AC:L). Limiting factors: the requirement for user interaction (the target must visit the page), the platform constraint (only Windows is confirmed affected), and the need for the ANGLE/GPU path to be engaged - disabling hardware acceleration/WebGL reduces reachability. There is no confirmed active exploitation and no public PoC, which further limits realistic near-term risk. |
| Impact | The signals are mixed but weighted toward priority patching. CVSS 9.6 with AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects network reachability, low complexity, no privileges, and a scope change (sandbox escape) - a serious combination requiring only that the victim open a page. Counterbalancing this, EPSS is low at 0.30% (22nd percentile), the issue is not on CISA KEV, and no public exploit or PoC is identified, so there is no evidence of exploitation in the wild. The one caveat is the requirement of user interaction (UI:R), which slightly lowers real-world exploitability versus a zero-click bug. Net assessment: a genuine high-severity browser RCE that should be patched promptly given Chrome's ubiquity, but current data does not indicate imminent mass exploitation - the low EPSS is consistent with a freshly disclosed, vendor-fixed bug rather than an actively weaponized one. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content and entices a victim to visit it (via phishing link, malicious ad, or compromised site). When Chrome's ANGLE component renders the content in the GPU process, the out-of-bounds write corrupts memory and can be chained to execute attacker code outside the sandbox on the Windows host. No public exploit or PoC is currently identified, and the attack requires the victim to load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on Windows via the Chrome stable channel, then fully restart the browser to load the new binary (Chrome auto-updates but the fix only takes effect after relaunch). Enterprises should push the update through their managed Chrome/Google Update policies and verify the running version. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. If patching cannot be completed immediately, interim compensating controls include disabling GPU acceleration/WebGL exposure to reduce reachability of ANGLE (via the '#ignore-gpu-blocklist'/hardware-acceleration settings or enterprise policy), which mitigates the attack surface at the cost of degraded graphics performance and broken WebGL sites, and restricting browsing to trusted sites; these are stopgaps only and do not substitute for the upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the graphics backend Chrome uses to translate WebGL/OpenGL ES calls to native APIs such as Direct3D on Windows; it runs in the GPU process and processes attacker-influenced rendering commands from web content. The root cause is CWE-787 (Out-of-bounds Write): input from a crafted HTML/WebGL page drives a write past the bounds of an allocated buffer, corrupting adjacent memory. Because ANGLE handles complex, low-level graphics state, such corruption in the GPU process is a well-known vector for sandbox escapes, which is why this issue is characterized as executing code 'outside the sandbox' rather than only within the renderer. The affected CPE is cpe:2.3:a:google:chrome, specifically the Windows desktop stable channel.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via a web page with no privileges (AV:N/PR:N) but requires the victim to visit it (UI:R); sandbox escape justifies S:C with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Windows (versions before 152.0.7977.65) contains a critical sandbox-escape vulnerability (CVSS 9.6) that allows remote code execution through malicious web pages; no public exploit code is currently identified. Despite low current exploitation risk (EPSS 0.3%), the potential impact-host-level compromise on Windows endpoints-demands immediate patching given Chrome's organization-wide deployment. All Windows users require Chrome 152.0.7977.65 or later to close this attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB