EUVD-2026-34356
GHSA-j7r9-qvx2-39rf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds write in the ANGLE graphics layer of Google Chrome versions prior to 149.0.7827.53 enables remote attackers to trigger heap corruption and potentially execute arbitrary code by luring a victim to a crafted HTML page. Chromium rates the severity as High and CVSS 8.8 reflects the network attack vector with required user interaction. No public exploit identified at time of analysis, though the bug class (memory corruption in a browser-exposed component) is historically a prime target for weaponization.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and other GPU APIs onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). The flaw maps to CWE-787 (Out-of-bounds Write), meaning the code writes past the bounds of an allocated buffer on the heap, corrupting adjacent memory structures. Because ANGLE processes attacker-controlled graphics commands sourced from web content (WebGL shaders, draw calls, texture data), a malicious page can shape heap state and trigger the write, a pattern frequently chained to code execution in the GPU process and used as a stepping stone toward sandbox escape.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 - update to this version or later via the Stable Channel release referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a browser restart so the fix takes effect (Chrome stages updates but does not activate them until restart). Enterprises should push the update via group policy (Windows), MDM (macOS), or package manager (Linux) rather than relying on user-initiated updates. For Chromium-derivative browsers, track vendor advisories from Edge, Brave, Opera, etc., and update once their rebased build ships. As a temporary compensating control while patching is rolled out, disabling WebGL via the chrome://flags or enterprise policy HardwareAccelerationModeEnabled=false reduces ANGLE attack surface but breaks legitimate WebGL-dependent sites and degrades rendering performance.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today