EUVD-2026-33219
GHSA-46cv-4fgx-p89x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows before 148.0.7778.216 lets a remote attacker who has already compromised the renderer process break out of the Chrome sandbox via a crafted HTML page that triggers a heap buffer overflow in ANGLE. The flaw carries CVSS 8.3 (High) and is rated Chromium-severity High, but EPSS is only 0.03% and there is no public exploit identified at time of analysis. Patched in the Stable channel update announced by Google on the Chrome Releases blog.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other OpenGL ES API calls onto the underlying platform graphics stack - on Windows it typically backs onto Direct3D. Because ANGLE runs inside the GPU/renderer process and parses attacker-influenced graphics commands originating from JavaScript/WebGL, memory-safety bugs in it are a classic pivot point from a compromised renderer into higher-privileged Chrome processes. The root cause is CWE-122 (Heap-based Buffer Overflow), meaning an out-of-bounds write into heap memory that an attacker can shape via crafted graphics state or shaders to corrupt adjacent objects and gain code execution outside the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the Windows build as the platform of concern per the description.
RemediationAI
Update Google Chrome on Windows to Vendor-released patch: 148.0.7778.216 or later via the Stable channel; Chrome's auto-updater will deliver this on restart, so the operational step in managed environments is to enforce a browser relaunch rather than rely on background update. Track Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding rebased releases as they ship. If patching must be deferred, the realistic compensating control is to disable hardware-accelerated graphics in Chrome (chrome://settings → System → 'Use hardware acceleration when available' off, or the HardwareAccelerationModeEnabled enterprise policy) which forces ANGLE down a software path and reduces, though does not eliminate, the attack surface - the trade-off is degraded WebGL/Canvas performance and battery life. Site Isolation should already be enabled (default) to limit renderer compromise blast radius, and high-risk users can be moved to a stricter browsing profile until patches roll out. Reference: https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today