EUVD-2026-50750
GHSA-mqwp-x4h4-hcg4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage issues malicious WebGL/graphics commands
-
ExploitTrigger out-of-bounds read/write in ANGLE
-
ExecutionCorrupt GPU/renderer memory
-
PersistEscape renderer sandbox
-
ImpactExecute code in higher-privilege context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled HTML page in an unpatched Chrome build before 151.0.7922.72 - user interaction (UI:R) is mandatory, so there is no zero-click or purely passive path. The crafted page must exercise the vulnerable ANGLE/WebGL code path, meaning the target must have ANGLE-backed graphics rendering active (the default; disabling WebGL or hardware acceleration removes the attack surface). Limiting factors: the outcome is described as a 'potential' sandbox escape rather than confirmed reliable code execution, no authentication is needed (PR:N) but the user must navigate to the malicious content, and only Chrome versions prior to the fixed 151.0.7922.72 build are affected. |
| Impact | The signals here are in tension and should be weighed carefully. The provided CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C) reflects a scope-changing sandbox escape reachable over the network with no privileges and only user interaction (visiting a page). However, Google labeled the Chromium security severity as 'Medium', and the description qualifies the impact as 'potentially perform a sandbox escape' - suggesting the escape is not fully proven or requires chaining. EPSS is low at 0.21% (11th percentile), the CVE is not on CISA KEV, and no public exploit is identified, so this is not evidence of widespread or imminent exploitation. The 9.6 CVSS therefore appears to overstate near-term operational risk relative to the vendor's Medium rating; treat it as a serious memory-safety browser bug worth prompt patching in Chrome's normal update cycle rather than an emergency zero-day. Note the conflict explicitly: high CVSS and scope change versus vendor 'Medium' severity and low EPSS - the word 'potentially' implies the sandbox escape may not be reliably weaponizable from this bug alone. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page containing malicious WebGL/graphics content and lures a victim to open it (phishing link or malvertising). When the page renders, ANGLE performs an out-of-bounds read and write while processing the crafted graphics commands, corrupting memory in a way that could allow the attacker to escape the renderer sandbox. No public proof-of-concept is currently identified, and reliable exploitation likely requires additional chaining given the vendor's Medium severity and the 'potentially' qualifier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel, then fully restart the browser to load the new build (Chrome auto-updates but requires a relaunch to apply). The fix is documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because the vulnerable code is in ANGLE/WebGL, an interim compensating control for high-risk fleets is to disable hardware acceleration or block WebGL (e.g., via enterprise policy 'HardwareAccelerationModeEnabled=false' or by disabling WebGL), which reduces the ANGLE attack surface but degrades graphics performance and breaks WebGL-dependent sites. Enforce managed auto-update policies so endpoints reach 151.0.7922.72 promptly, and verify Chromium-based browsers (Edge, Brave, Opera) are updated to their equivalent patched releases.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's graphics abstraction library that translates OpenGL ES / WebGL API calls into the platform's native GPU backend (Direct3D, Metal, Vulkan, or desktop GL). Because it processes untrusted WebGL/graphics commands originating from web content, ANGLE runs at a security-sensitive boundary between the sandboxed renderer and the GPU process. The root cause is CWE-125 class memory safety failure - an out-of-bounds read combined with an out-of-bounds write, indicating missing or incorrect bounds validation when parsing or executing crafted graphics commands. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all builds before 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via a crafted page needing user interaction; AC:H because a memory-corruption sandbox escape via ANGLE requires non-trivial heap grooming, and S:C reflects breaking out of the renderer sandbox.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome users across your organization face potential system compromise through a critical sandbox escape flaw in the graphics layer, which could allow attackers to execute code via malicious websites. The vulnerability affects Chrome versions prior to 151.0.7922.72, and while no public exploit identified at time of analysis, the severity of a sandbox bypass justifies immediate remediation to protect business continuity and system integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB