EUVD-2026-54266
GHSA-mp77-8pgf-mvpr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote page-load delivery with UI:R and scope change for sandbox escape; AC:H because reliable OOB-write exploitation and sandbox escape require significant crafting, not trivial triggering.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome for Android before 151.0.7922.109 stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/GPU translation layer, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt GPU-process memory and potentially break out of the renderer sandbox. Chromium rates the issue Critical and a vendor patch is available, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. The high CVSS 9.6 reflects the scope-changing sandbox-escape potential rather than confirmed in-the-wild use.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the graphics abstraction Chrome uses to translate WebGL/OpenGL ES calls onto the platform's native GPU backend (on Android, typically Vulkan/OpenGL ES). It runs in Chrome's privileged GPU process, so memory-safety bugs here are especially dangerous. The root cause is CWE-787 (Out-of-bounds Write): attacker-controlled input processed by ANGLE causes a write past an allocated buffer boundary, corrupting adjacent memory. Because the GPU process sits at a higher privilege boundary than the sandboxed renderer, controlled corruption here can be leveraged toward a sandbox escape rather than a mere renderer crash.
RemediationAI
Vendor-released patch: update Google Chrome on Android to 151.0.7922.109 or later via the Google Play Store as the primary and definitive fix, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html). In managed fleets, push the update through MDM/enterprise policy and verify the effective version on devices. Because exploitation requires the victim to render a malicious page, interim compensating controls until devices are updated include restricting browsing to trusted sites, deploying web/URL filtering to block untrusted content, and - where operationally acceptable - disabling hardware-accelerated GPU/WebGL rendering to shrink the ANGLE attack surface; note this can degrade rendering performance and break WebGL-dependent sites, and it is a mitigation, not a substitute for patching.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today