EUVD-2026-34404
GHSA-v8cp-r57p-rcv9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Type confusion in the ANGLE graphics translation layer of Google Chrome on Windows prior to 149.0.7827.53 enables remote attackers to trigger out-of-bounds memory access through a crafted HTML page, with potential for memory corruption leading to code execution in the renderer process. Chromium rates this High severity and a vendor patch is available, though no public exploit is identified at time of analysis and EPSS exploitation probability is currently 0.03%.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses on Windows to translate WebGL and other OpenGL ES calls into the host platform's native graphics API, typically Direct3D. The root cause is CWE-843 (Access of Resource Using Incompatible Type, also known as type confusion), where the code accesses an object assuming one type while it is actually a different incompatible type. In a GPU translation layer this typically arises when shader inputs, buffer descriptors, or shared GL state are reinterpreted between WebGL-facing and D3D-facing code paths, allowing attacker-controlled data to be treated as a pointer, vtable, or sized object it was never meant to be, producing out-of-bounds reads or writes inside the renderer/GPU process.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 for Windows; update via Chrome's built-in updater (chrome://settings/help) or push the fixed build through enterprise management (Google Update / Chrome Browser Cloud Management), per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Until the patch is deployed, compensating controls include disabling WebGL via the policy DefaultWebUsbGuardSetting/feature flag chrome://flags/#disable-webgl or the enterprise policy WebGLAllowed=false, which neutralizes the most likely trigger path through ANGLE but breaks legitimate WebGL/Canvas-accelerated sites; alternatively, force the SwiftShader software renderer via --use-gl=swiftshader to bypass D3D-backed ANGLE paths, accepting a measurable performance hit on graphics-heavy pages. Site isolation and the renderer sandbox remain on by default and should be left enabled to constrain blast radius. Downstream Chromium browsers should be updated to whichever release first incorporates Chromium 149.0.7827.53.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today