EUVD-2026-50808
GHSA-9vq8-3c74-6rf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior exploit
-
DeliveryServe crafted HTML with malicious WebGL
-
ExploitTrigger integer overflow in ANGLE
-
ExecutionCorrupt memory across sandbox boundary
-
PersistEscape sandbox to GPU/host process
-
ImpactExecute code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process - this is an explicit prerequisite stated in the CVE description, making the bug a sandbox-escape (second-stage) primitive rather than a standalone initial-access flaw. It further requires the victim to load attacker-controlled content: a crafted HTML page (UI:R), whose code exercises the WebGL/graphics operations handled by ANGLE. Limiting factors that reduce realistic risk: the mandatory prior renderer compromise, the required user interaction of loading the crafted page, applicability only to Chrome builds before 151.0.7922.72, and that environments with WebGL/GPU acceleration disabled reduce reachability of the vulnerable code. |
| Impact | Signals are mixed and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects Chromium's convention of scoring the network-facing browser attack surface with scope change for a sandbox escape, but the description explicitly states the attacker must have ALREADY compromised the renderer process - a substantial prerequisite the raw vector understates by using PR:N/AC:L. In practice this is a chained, second-stage bug requiring a separate renderer exploit first, which materially raises real-world attack complexity. Against this, EPSS is low (0.29%, 21st percentile), there is no KEV listing, and there is no public POC, so there is no evidence of widespread or imminent exploitation. Net assessment: a genuine priority for Chrome fleets because of its role in a full browser exploit chain and Chrome's ubiquity, but not a drop-everything unauthenticated RCE - treat it as a high-priority routine patch rather than emergency incident response, absent new exploitation intelligence. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-process vulnerability, for example via a malicious or compromised website the victim visits, then serves a crafted HTML page containing malicious WebGL content that triggers the integer overflow in ANGLE, corrupting memory to escape the sandbox and run code in a higher-privileged process on the host. No public POC is identified at this time, and the multi-stage requirement (renderer compromise plus user visiting attacker-controlled content, per UI:R) increases realistic attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 - upgrade to 151.0.7922.72 or later on all desktop platforms, which is the primary and complete fix (see the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome typically auto-updates on relaunch, so ensure endpoints are restarted to apply the update and verify the running build via chrome://version. Where immediate patching is not possible, compensating controls include disabling hardware-accelerated GPU/WebGL by turning off 'Use graphics acceleration when available' in chrome://settings or via the --disable-gpu / --disable-webgl launch flags, or blocking WebGL through enterprise policy, which reduces reachability of the vulnerable ANGLE code path; the trade-off is degraded rendering performance and broken WebGL-dependent web applications. Because exploitation also requires a prior renderer compromise, keeping Chrome's site isolation enabled and restricting installation of untrusted extensions further limits the practical attack chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction library that translates OpenGL ES / WebGL calls into the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). The root cause is CWE-190, an integer overflow: an arithmetic operation on attacker-influenced values such as buffer sizes or vertex/texture dimensions supplied through WebGL wraps around, producing an undersized allocation or out-of-bounds index that corrupts memory. Because ANGLE code runs at the boundary between the sandboxed renderer and the more privileged GPU process, memory corruption here can be leveraged to escape the renderer sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*, and the tags (Integer Overflow, Buffer Overflow) confirm the overflow manifests as a buffer memory-safety violation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered via a crafted page (AV:N, UI:R) but requires a prior renderer compromise plus overflow grooming, so AC:H; the sandbox escape crosses a trust boundary (S:C) with full host impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome's ANGLE graphics library contains a critical sandbox escape vulnerability (CVE-2026-17682) affecting versions before 151.0.7922.72 that enables attackers with compromised browser processes to gain full system access. With no public exploit identified at time of analysis, current exploitation remains unlikely at 0.3% EPSS, but this vulnerability creates a high-risk second-stage attack path should any employee's browser become compromised, potentially enabling system-wide breach. Organizations must rapidly deploy available patches to eliminate this lateral movement vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB