EUVD-2026-50847
GHSA-m2x7-p454-5w3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryDeliver crafted WebGL/HTML content
-
ExploitTrigger OOB write in ANGLE
-
ExecutionCorrupt GPU process memory
-
PersistEscape Chrome sandbox
-
ImpactExecute code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML/graphics content in a vulnerable Chrome build (<151.0.7922.72) with GPU acceleration active so that the ANGLE code path processes the crafted data - this matches CVSS UI:R (user interaction required). No authentication is needed (PR:N) and the attack is remote (AV:N) with low complexity (AC:L). Limiting factors: the attack is not drive-by-automatic in the sense that the user must be induced to visit/render the page; a full sandbox escape realistically depends on chaining the ANGLE memory corruption with additional primitives; and disabling hardware acceleration removes or reduces the ANGLE attack surface. The advisory does not enumerate a special non-default configuration beyond normal GPU-accelerated browsing. |
| Impact | The signals are partially conflicting and warrant nuance. CVSS 3.1 is 9.6 (Critical) driven by AV:N, AC:L, PR:N, scope change (S:C) and C:H/I:H/A:H, reflecting the severe consequence of a sandbox escape; however, UI:R means the attack is not automatic - a user must visit or be lured to a malicious page. Against that high CVSS, EPSS is only 0.21% (11th percentile) and the CVE is NOT on CISA KEV, and no POC is referenced, so real-world exploitation pressure is currently low. This is a genuine high-priority patch for any browser fleet because browser sandbox escapes are prime targets for exploit-chain developers and are historically retrofitted into in-the-wild chains, but as of this analysis it is a high-severity-but-not-yet-exploited issue rather than an active emergency. Note the low EPSS is consistent with a freshly disclosed, vendor-reported bug that has not yet been reverse-engineered publicly. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content and lures a victim to visit it (via phishing link, malvertising, or a compromised site). When the page renders, the ANGLE out-of-bounds write corrupts GPU-process memory, and - typically chained with a renderer bug - the attacker escapes the Chrome sandbox to run code with the GPU process's privileges. No public POC is referenced at time of analysis, and success requires the low-complexity but user-interaction-dependent step of the victim opening the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.
RemediationAI
Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel (verify through chrome://settings/help, which triggers the background updater, then relaunch the browser to apply it); managed fleets should push the update through their enterprise update policy or MDM. Details are in the Chrome release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until the update is deployed, meaningful compensating controls are limited because the trigger is web content: you can disable hardware GPU acceleration (chrome://settings 'Use graphics acceleration when available', or the --disable-gpu / HardwareAccelerationModeEnabled=false policy) to reduce ANGLE's exposure, at the cost of degraded rendering performance and video decode; and you can restrict browsing to trusted sites via URL allowlisting, at the cost of user friction. Chromium-based browsers should be updated to the build that incorporates the upstream ANGLE fix once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses to translate WebGL and OpenGL ES calls into the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux/Android). It executes inside Chrome's GPU process, which is sandboxed but more privileged than the renderer for hardware access. The root cause is CWE-787 (Out-of-bounds Write): malformed graphics commands or shader/geometry data drive a write past the bounds of an allocated buffer, corrupting adjacent memory. Because ANGLE processes untrusted, web-supplied graphics data, a page can steer this corruption to achieve memory control within the GPU process and, per the advisory, escape the sandbox. The single affected CPE is cpe:2.3:a:google:chrome (all versions below 151.0.7922.72).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no auth (AV:N/PR:N) but requires the user to load it (UI:R); the sandbox escape crosses a trust boundary (S:C) with full CIA impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop browsers versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability that could enable attackers to fully compromise affected systems through malicious web pages. While no public exploit code has been identified, the broad user base and severe technical impact warrant immediate patching. A vendor patch is available for deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB