EUVD-2026-65804
GHSA-8pj6-x3r7-fgx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious WebGL/graphics content
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionCorrupt GPU-process memory
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content (UI:R) - for example visiting a malicious page or being served a malicious ad/iframe - that exercises ANGLE's graphics processing path (WebGL or accelerated rendering). No authentication and no prior privileges are needed (PR:N). Limiting factors: exploitation is gated on user interaction (opening the page) and on ANGLE/GPU acceleration being active; environments that disable hardware acceleration or WebGL reduce reachability of the vulnerable code, and browsers already updated to 152.0.7977.65 or later are not affected. |
| Impact | Signals conflict on urgency. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) rates this critical due to network reach, no privileges, and a scope change consistent with a sandbox escape - offset by UI:R (the victim must open a malicious page). However, EPSS is low at 0.25% (16th percentile), there is no KEV listing (not actively exploited), and no POC is referenced, and Chromium's own severity rating is 'High' rather than 'Critical.' This is a genuinely high-impact class of bug (GPU-process OOB write in a ubiquitous browser) but currently shows no evidence of exploitation, so it warrants prompt patching on the normal Chrome update cadence rather than emergency out-of-band response. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malicious WebGL/graphics content and lures a victim (via phishing link, malvertising, or a compromised site) to open it in a vulnerable Chrome build. The crafted content triggers an out-of-bounds write in ANGLE within the GPU process, corrupting memory to potentially execute attacker code outside the renderer sandbox. No POC is referenced in the available data; exploitation requires the single user interaction of visiting the page (AV:N/AC:L/UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Out-of-bounds write in Google Chrome's ANGLE graphics layer allows a remote attacker who lures a victim to a crafted HTML page to potentially execute arbitrary code outside the browser sandbox, affecting all Chrome builds prior to 152.0.7977.65. The CVSS:3.1 score of 9.6 reflects a scope-changing sandbox escape requiring only user interaction (visiting a page). No public exploit is identified at time of analysis and the EPSS probability is low (0.25%, 16th percentile), and it is not on CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later via the Stable channel (Help > About Google Chrome, then relaunch); managed fleets should push the update through their management channel and force a browser restart to load the fix. Refer to the Chrome release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. If immediate patching is not possible, compensating controls include disabling hardware-accelerated graphics/WebGL to reduce ANGLE's attack surface - via the '#ignore-gpu-blocklist' avoidance plus disabling 'Use graphics acceleration when available' or the WebGL enterprise policies - which reduces exposure but degrades rendering performance and breaks WebGL-dependent sites; and applying strict web filtering to limit exposure to untrusted pages. Users of other Chromium-based browsers should install the vendor build that incorporates the equivalent Chromium fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction layer that translates WebGL/OpenGL ES calls to the platform's native GPU backend (Direct3D, Metal, Vulkan, or desktop GL). It runs partly in the GPU process, which is a higher-privilege boundary than the sandboxed renderer, so memory-safety defects here are especially dangerous. The root cause is CWE-787 (Out-of-bounds Write): attacker-influenced data causes a write past the bounds of an allocated buffer, corrupting adjacent memory. Because ANGLE processes graphics commands originating from untrusted web content, a crafted HTML/WebGL page can steer the write to achieve memory corruption that, per the advisory, may lead to code execution outside the sandbox.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N) needs the victim to open it (UI:R); a sandbox escape crosses trust boundaries (S:C) with full code-execution impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 152.0.7977.65 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that allows remote attackers to execute arbitrary code on affected systems through a malicious web page, with no public exploit currently identified, exposing the organization to potential system compromise, data theft, and malware installation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB