EUVD-2026-33227
GHSA-hwhg-7c6p-xfw2
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox via a use-after-free in the ANGLE graphics layer. Exploitation requires user interaction (visiting a crafted HTML page) and a pre-existing renderer compromise, so it functions as the second stage of an exploit chain rather than a standalone RCE. No public exploit identified at time of analysis and EPSS is very low (0.03%), but Chrome rates the underlying flaw as High severity.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other OpenGL ES calls to the host platform's graphics API - on Windows this is typically Direct3D 11. Because ANGLE runs partly in the more privileged GPU process and exposes a complex interface to renderer-supplied WebGL commands, memory-safety bugs in this code path are a classic sandbox-escape vector. The root cause is CWE-416 (Use After Free): an object is freed while a pointer to it remains live, and subsequent dereference of that pointer allows an attacker who controls the heap state from a compromised renderer to corrupt memory in a more privileged process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on the Windows platform specifically.
RemediationAI
Vendor-released patch: update Google Chrome on Windows to 148.0.7778.216 or later via the Stable channel (see https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and https://nvd.nist.gov/vuln/detail/CVE-2026-9932); enterprise admins should push the update through Chrome Browser Cloud Management, Group Policy, or their endpoint-management tooling and force a browser relaunch to ensure the renderer and GPU processes actually pick up the fix. For Chromium-based browsers, install the equivalent vendor build once published. If patching must be deferred, reduce exposure by disabling WebGL (chrome://flags or policy 'Disable3DAPIs'=true), which removes the ANGLE attack surface at the cost of breaking WebGL-dependent sites and apps; site isolation and strict allowlists for risky browsing reduce but do not eliminate the chained-exploit risk. Do not rely on Windows AppContainer or EDR alone, as the bug specifically targets the sandbox boundary.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today