EUVD-2026-50581
GHSA-r3xh-r9mw-vh95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML/WebGL to ANGLE
-
ExploitTrigger use-after-free in graphics layer
-
ExecutionCorrupt GPU-process memory
-
ImpactEscape sandbox to higher-privilege context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (explicitly stated in the description) - this is a second-stage sandbox-escape primitive, not an initial-access vector. Beyond that foothold, the attacker must lure the victim to a crafted HTML page (UI:R - user interaction/browsing required) that exercises the vulnerable ANGLE graphics path, and win the use-after-free timing condition. Limiting factors: the pre-existing renderer compromise dependency, required user interaction (visiting attacker content), and the fact that a fully updated browser (≥151.0.7922.72) or one with hardware acceleration disabled removes the reachable code path. These prerequisites make real-world exploitation substantially harder than the AV:N/PR:N CVSS metrics suggest. |
| Impact | The signals are notably in tension. The NVD CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C) implying near-critical network-exploitable risk, yet the description explicitly requires an attacker to have ALREADY compromised the renderer process - a prerequisite that CVSS's PR:N/AC:L metrics do not capture, and Google itself rated the Chromium severity only Medium. EPSS is low at 0.17% (7th percentile), the CVE is NOT on CISA KEV, and no POC is referenced, all consistent with a bug that is dangerous only as the second link in an exploit chain. Realistically this is a sandbox-escape primitive: high impact if reached, but not independently exploitable against a patched or well-isolated browser. Treat it as a standard Chrome update priority rather than an emergency, while recognizing that if paired with a renderer RCE it delivers full escape. The gap between the 9.6 CVSS and the Medium vendor rating should be resolved in favor of the description - verify exploitation prerequisites before ranking this above other Chrome fixes. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer vulnerability when the victim visits a malicious or compromised site, gaining code execution inside Chrome's sandboxed renderer. From that foothold, the attacker serves crafted HTML/WebGL content that drives ANGLE into the use-after-free condition, corrupting memory to escape the sandbox into the GPU/browser process. No public exploit is identified at time of analysis, so this remains a theoretical chain reflecting the CVSS UI:R (user must visit a page) and the stated renderer-compromise prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on managed fleets, force the update and relaunch since Chrome only applies pending updates on restart, and confirm rollout through chrome://settings/help. See the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not possible, reduce exposure by restricting untrusted web browsing and, where acceptable, disabling hardware-accelerated graphics (chrome://settings, 'Use graphics acceleration when available', or the --disable-gpu flag) to limit reachability of the ANGLE code path - with the trade-off of degraded WebGL/rendering performance. Because exploitation also requires a prior renderer compromise, keeping site isolation enabled (default) and applying all concurrent renderer-RCE fixes in the same release meaningfully raises the bar. Chromium-based browsers should be updated to builds incorporating the equivalent ANGLE fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform graphics abstraction that translates WebGL/OpenGL ES calls onto native backends (Direct3D, Metal, Vulkan, desktop GL). It runs across the renderer/GPU boundary and is a recurring source of memory-safety bugs because it processes attacker-influenced graphics command streams. The root cause is a use-after-free (CWE-416): an object is freed while a dangling reference remains reachable, and subsequent access to that stale pointer lets an attacker corrupt memory. Because ANGLE straddles the sandbox boundary, corrupting its state from a compromised renderer can be leveraged to execute code in the more-privileged GPU/browser context. The affected component is the Chrome desktop browser (cpe:2.3:a:google:chrome), fixed in the 151.0.7922.72 stable channel build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation requires a pre-existing renderer compromise plus winning a UAF race; UI:R for visiting crafted content; S:C and C/I/A:H reflect full sandbox escape to a higher-privilege process.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17832) that could enable full system compromise following an initial browser compromise. While the CVSS score of 9.6 reflects severe technical risk, no public exploit code has been identified and the vulnerability requires pre-existing renderer process compromise, limiting immediate organizational exposure. Organizations must prioritize patching Chrome to version 151.0.7922.72 or later to eliminate this post-compromise escalation path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB