EUVD-2026-50844
GHSA-p4j8-jw78-gvc8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted WebGL/HTML content
-
ExploitTrigger use-after-free in ANGLE
-
ExecutionCorrupt heap in GPU process
-
PersistEscape renderer sandbox
-
ImpactExecute code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled web content in Chrome (CVSS UI:R - user interaction such as visiting a malicious page or rendering a malicious ad/iframe). The vulnerable code path is ANGLE's graphics/WebGL processing, so the malicious page must exercise the affected ANGLE object handling to trigger the use-after-free. No authentication or pre-existing privileges are needed (PR:N). Limiting factors: it only affects Chrome (and Chromium derivatives) prior to 151.0.7922.72, the description qualifies the sandbox escape as 'potentially' (not a demonstrated reliable escape), a full escape typically requires defeating additional sandbox layers, and CISA SSVC marks it non-automatable with no known exploitation. |
| Impact | The signals are mixed but coherent. CVSS 3.1 is 9.6 (Critical) driven by network vector, low complexity, no privileges, and a scope change with total C/I/A impact - a plausible sandbox escape carries high theoretical severity. However, the real-world exploitation signals are low: EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no POC or KEV listing exists. Note the CVSS requires UI:R (user must visit a malicious page) and the description itself uses the word 'potentially,' indicating a demonstrated escape is not confirmed. The SSVC Technical Impact of 'total' aligns with the sandbox-escape claim. Net: this is a high-priority patch for any Chrome fleet because of the impact ceiling and trivial delivery, but there is no evidence of active or automatable exploitation, so it is an urgent-routine patch rather than an emergency incident. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content and lures a victim to visit it (or delivers it via a malicious ad/iframe). Rendering the page triggers the use-after-free in ANGLE, corrupting memory to potentially escape the renderer sandbox and run code at higher privilege on the host. No public POC has been identified, and successful exploitation requires user interaction (visiting the page). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel per the Chrome release advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); most environments receive this via Chrome's automatic updater, so verify the update actually applied and relaunch the browser to complete it, since Chrome does not swap the running binary until restart. In managed fleets, push the update through your enterprise policy/MDM and confirm version compliance. As an interim compensating control before patching, you can reduce ANGLE/WebGL attack surface by disabling hardware acceleration or WebGL (chrome://settings or the WebGLDisabled / policy controls) - trade-off: this degrades graphics performance and breaks WebGL/3D content and some video features. Users of other Chromium-based browsers should apply the equivalent vendor update once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in ANGLE (Almost Native Graphics Layer Engine), Chrome's translation layer that maps OpenGL ES / WebGL calls onto the host platform's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced GPU commands originating from web content, a memory-safety defect here is reachable from any rendered page. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains, and subsequent access to that freed memory can corrupt the heap. In Chrome's multi-process model this component runs with enough privilege that corrupting it can pivot out of the renderer, which is why the CVSS scope is marked Changed (S:C).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered via a crafted page (AV:N, UI:R, PR:N) with a renderer-to-host scope change; AC:H because reliable use-after-free sandbox escapes require precise heap grooming.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 151.0.7922.72 contain a critical vulnerability allowing remote code execution on user endpoints through a single malicious webpage. This sandbox escape in the ANGLE graphics library could permit attackers to bypass Chrome's security isolation and compromise sensitive user data or establish persistent access to organizational systems.
Apply vendor patch: Chrome 151.0.7922.72 or later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB