EUVD-2026-33082
GHSA-3ggw-gm74-wqqp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Heap corruption in Google Chrome's ANGLE graphics layer prior to version 148.0.7778.216 allows remote attackers to potentially achieve code execution within the renderer process when a victim visits a crafted HTML page. Google rated the issue High severity and has shipped a stable-channel fix; no public exploit identified at time of analysis and EPSS is currently 0.03% (10th percentile), indicating low observed exploitation interest despite the strong technical impact.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that maps WebGL and other OpenGL ES API calls onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). The flaw is classified as CWE-122 (Heap-based Buffer Overflow), meaning attacker-controlled input - here, graphics commands or shader data parsed from a malicious page - causes a write past the bounds of a heap-allocated buffer inside ANGLE. Because ANGLE runs in-process with the renderer (and on some paths the GPU process), corruption of heap metadata or adjacent objects can be steered toward control-flow hijack or sandboxed memory disclosure, though Chrome's site-isolation and GPU sandbox still gate full system compromise.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.216 - update the desktop stable channel to this version or later via Chrome's built-in updater (Help → About Google Chrome), and restart the browser to complete the relaunch step that actually loads the patched ANGLE binary, as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise fleets should push the update via Google's MSI/PKG channels or management policies and verify version reporting. If patching must be deferred, the most direct compensating control is disabling hardware-accelerated graphics (chrome://settings → System → 'Use graphics acceleration when available' off, or the HardwareAccelerationModeEnabled=false enterprise policy) to reduce ANGLE attack surface; this degrades WebGL, video decoding, and canvas performance. Additional defense in depth: block WebGL via the WebGlEnabled=false policy (breaks legitimate 3D/graphics sites), and rely on site-isolation plus URL/category filtering at the proxy to limit exposure to untrusted HTML. For Chromium derivatives, apply the corresponding vendor build that incorporates the ANGLE fix.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today