EUVD-2026-50797
GHSA-m365-x9xq-2p8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryExploit separate renderer bug for code execution
-
ExploitSend malformed graphics input to ANGLE
-
ExecutionTrigger improper input validation in GPU process
-
PersistEscape sandbox to higher privilege
-
ImpactFull control of browser process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the renderer process (per the description) - this bug alone is a second-stage sandbox escape, not an initial entry point. It further requires user interaction (UI:R): the victim must load a crafted HTML page in a vulnerable Chrome build (< 151.0.7922.72). Limiting factors that reduce real-world risk: the mandatory prior renderer compromise (a full chain is needed), the need for user navigation to attacker-controlled content, and the absence of any public POC or active exploitation. Disabling WebGL/hardware acceleration would remove much of ANGLE's reachable attack surface. |
| Impact | The signals are mixed and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6 Critical) reflects a scope-changing sandbox escape with total impact, but the description makes clear this is a chained bug requiring the attacker to have ALREADY compromised the renderer process - so PR:N/AV:N describe the outer web-delivery step, not a standalone one-shot exploit. CISA SSVC aligns with the lower real-world urgency: Exploitation=none, Automatable=no, Technical Impact=total. EPSS is low at 0.29% (21st percentile) and there is no KEV listing and no public POC, so despite the high CVSS this is not evidence of imminent widespread attack. The 'total technical impact' plus 'sandbox escape' means it is a valuable component in a full exploit chain, so it warrants prompt patching, but as an isolated CVE it is a chain-link rather than a single-stage remote code execution. Note: the input Tags say 'Information Disclosure' which conflicts with the description's sandbox-escape framing and CVSS C:H/I:H/A:H - treat the tag as unreliable and rely on the description. |
| Exploit ScenarioDerived | An attacker lures a user to a malicious or compromised web page that first exploits a separate renderer vulnerability to gain code execution inside the sandboxed renderer, then leverages this ANGLE input-validation flaw to send crafted graphics commands that escape the sandbox into the higher-privileged GPU/browser process. No public exploit is identified at time of analysis, so this remains a plausible chained scenario rather than a confirmed in-the-wild attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though it requires a pre-existing renderer compromise as a chained prerequisite. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%).
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - update to this build or later on the Stable channel via the built-in updater (chrome://settings/help) and relaunch to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed fleets, push the update through Google Update / enterprise policy and force a browser restart, since ANGLE code is only reloaded on relaunch. Users of other Chromium-based browsers should apply their vendor's corresponding update once it incorporates the ANGLE fix. If immediate patching is not possible, compensating controls include disabling hardware acceleration / WebGL (chrome://settings, 'Use graphics acceleration when available', or the WebGL enterprise policy) to reduce ANGLE attack surface - trade-off is degraded rendering/performance for graphics-heavy sites - and restricting untrusted browsing via site isolation and application allow-listing to lower the chance of the prerequisite renderer compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL API calls into the platform-native backend (Direct3D, Metal, Vulkan, or desktop GL). It runs partly in the GPU process, which sits at a higher privilege boundary than the sandboxed renderer. The root cause is classified as CWE-20 (Improper Input Validation): ANGLE insufficiently validates untrusted input passed from the renderer, which a compromised renderer can abuse to cross the process/sandbox boundary. The single affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H because exploitation requires a pre-existing renderer compromise and chained conditions; UI:R for page load; S:C and C/I/A:H reflect a full sandbox escape into the GPU/browser process.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical sandbox escape in Google Chrome's ANGLE graphics component (CVE-2026-17671, CVSS 9.6) allows attackers who have compromised a browser renderer process to gain complete system access by breaking Chrome's security isolation. This affects all Chrome versions before 151.0.7922.72 and eliminates a key protective boundary in your organization's defense-in-depth strategy. Immediate deployment of the patch is required to restore this critical security isolation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB