Chrome EUVD-2026-17787

Requires Google Chrome on Windows versions prior to 146.0.7680.178. Attacker must first compromise the renderer process, then trick the victim into opening a crafted HTML page. Affects default Chrome installations.

While CVSS and EPSS scores are unavailable, multiple risk signals indicate a medium-to-high real-world priority: (1) Chromium's own High severity rating reflects significant technical impact; (2) the attack requires prior renderer compromise, which already represents a breach of the sandbox boundary-this is not a single-stage exploitation but a post-compromise escalation; (3) no public exploit code or KEV status is indicated, suggesting no active mass exploitation at time of analysis, though the fixed version date (March 2026 release) indicates disclosure may be recent; (4) the integer-to-overflow chain is a well-understood attack class with moderate complexity but high impact once triggered. Priority should be elevated for systems where renderer sandbox escape is a concern (e.g., untrusted content rendering), but lower for standard browsing of trusted sites. The absence of CVSS data prevents precise SSVC scoring, but the requirement for renderer compromise lowers exploitation probability in typical scenarios.

An attacker who has already compromised the Chrome renderer process (via a separate exploit such as a use-after-free or type confusion in rendering code) crafts a malicious HTML page containing specially formed graphics commands that trigger an integer overflow in ANGLE's buffer size calculation. The overflow causes the allocation routine to reserve insufficient memory, and subsequent writes overflow the heap boundary, potentially allowing the attacker to overwrite adjacent memory structures and escalate privileges from the sandboxed renderer process to the browser process or execute arbitrary code within renderer context. No public proof-of-concept code has been identified, indicating this is not yet a commodity exploit despite the relatively straightforward integer-overflow-to-overflow pattern.