EUVD-2026-65798
GHSA-7rjp-wm4x-4x9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted WebGL HTML content
-
ExploitTrigger use-after-free in WebGL
-
ExecutionCorrupt GPU/renderer memory
-
PersistEscape browser sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome build (before 152.0.7977.65) with WebGL enabled, which is the default configuration - the description specifies delivery 'via a crafted HTML page.' The limiting factor is user interaction (CVSS UI:R): the target must navigate to or render the malicious page (direct visit, iframe, ad, or embedded content); no authentication or elevated privileges are needed (PR:N). Exploitation is meaningfully constrained where WebGL/GPU acceleration is disabled by policy, and full impact depends on chaining the WebGL UAF into a working sandbox escape, which is non-trivial (SSVC Automatable: no). |
| Impact | Signals conflict and must be weighed carefully. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - network reachable, low complexity, no privileges, only user interaction (visiting a page) required, with a scope change reflecting the claimed sandbox escape. Against that, EPSS is only 0.33% (25th percentile), SSVC records Exploitation:none and Automatable:no, and there is no KEV listing or public POC - indicating no observed in-the-wild activity yet. The high CVSS is driven by worst-case impact (Technical Impact: total) rather than demonstrated exploitation. Net: patch promptly because browser UAFs are historically weaponizable and the sandbox-escape claim is serious, but there is currently no evidence of active or automatable exploitation, so this is high-severity-by-potential rather than confirmed imminent threat. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL calls and lures a victim to visit it (via phishing link, malvertising, or a compromised site). When the page renders, the WebGL use-after-free is triggered, corrupting memory in the GPU/renderer path; per the vendor description this can be leveraged to execute arbitrary code outside the sandbox. No public exploit code is identified at time of analysis, but the low attack complexity and drive-by nature make weaponization plausible if a POC emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome's WebGL component affects all desktop builds prior to 152.0.7977.65. A crafted HTML page can trigger a use-after-free (CWE-416) whose exploitation, per the description, yields code execution outside the browser renderer sandbox - a notably severe outcome that Chrome typically confines. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.33% (25th percentile), consistent with SSVC marking exploitation as 'none' despite total technical impact.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Chrome to 152.0.7977.65 or later via the Chrome Stable channel and relaunch the browser to load the fix (see https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). In managed environments, push the update through your enterprise update policy and verify version compliance across the fleet. If immediate patching is not possible, reduce exposure by disabling WebGL - for example via the chrome://flags/#disable-webgl setting or the enterprise policy that blocks WebGL/GPU acceleration - which removes the vulnerable attack surface at the cost of breaking legitimate 3D/WebGL content and some GPU-accelerated pages. Restricting browsing to trusted sites and enabling site isolation are secondary controls, but the definitive remediation is the version upgrade. Users of other Chromium-based browsers should apply their vendor's corresponding update once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebGL is Chrome's JavaScript-accessible GPU rendering API, backed by ANGLE and the GPU process, which parses complex attacker-supplied geometry, shader, and texture state. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, letting subsequent WebGL operations reuse the stale allocation and corrupt memory. Because WebGL bridges the renderer to the more-privileged GPU process, memory corruption here is a classic path toward escaping Chrome's multi-process sandbox. The single affected CPE is cpe:2.3:a:google:chrome, i.e. the Chrome desktop browser itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a visit (UI:R, PR:N, AC:L); the described sandbox escape justifies S:C with full C/I/A impact on the host.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome's WebGL component contains a critical vulnerability (pre-version 152.0.7977.65) that allows remote code execution outside the browser sandbox, enabling full system access to compromised users. No public exploit has been identified at time of analysis, but the vulnerability's severity and broad attack surface across all Chrome desktop users requires immediate patching. Deployment of version 152.0.7977.65 or later is essential before exploitation tools emerge.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB