EUVD-2026-65794
GHSA-9hwr-29v4-x75x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage delivers malicious WebGL content
-
ExploitTrigger heap buffer overflow in WebGL
-
ExecutionCorrupt memory to escape sandbox
-
ImpactExecute arbitrary code at browser privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build (before 152.0.7977.65) with WebGL processing reachable - i.e., WebGL/hardware-accelerated rendering enabled, which is the default configuration. The concrete prerequisite is that the malicious page's WebGL content is rendered by the browser; per CVSS UI:R, this needs one user action (navigating to or opening the page) but no further interaction, authentication, or local access (PR:N). Limiting factors: the user must actually visit the attacker-controlled content, the browser must be an unpatched version, and if WebGL/hardware acceleration has been disabled by policy the attack surface is removed; there is no known automated/wormable exploitation (SSVC Automatable: no) and no observed in-the-wild use. |
| Impact | The signals here are partly in tension and should be read together. CVSS 3.1 rates this 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - network-reachable, low complexity, no privileges, only user interaction (visiting a page) required, with a sandbox-escaping scope change and total confidentiality/integrity/availability impact. Against that, CISA SSVC records Exploitation: none and Automatable: no, and EPSS is only 0.39% (31st percentile), and there is no CISA KEV listing and no known POC. The reconciling interpretation: the technical impact is genuinely severe (SSVC Technical Impact: total), but there is currently no evidence of exploitation in the wild and no drive-by-automatable exploit, so real-world risk today is moderate and driven by potential rather than observed abuse. Chrome's ubiquity means the exposed population is enormous, so even a mid-sized municipal IT team should treat this as an urgent update; browser RCE-with-sandbox-escape bugs are historically attractive to exploit developers, so the low EPSS should be read as 'not yet weaponized,' not 'safe to defer.' |
| Exploit ScenarioDerived | An attacker hosts a malicious web page (or injects into an ad/compromised site) containing crafted WebGL content and lures a victim to open it. When the victim's pre-152.0.7977.65 Chrome renders the page, the heap overflow in WebGL is triggered and leveraged to escape the sandbox and run attacker code with the browser's privileges. No public exploit is known at time of analysis, but only a single page visit (UI:R) is required - no clicks, downloads, or credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a heap buffer overflow in the WebGL component, and critically allows an attacker to execute code OUTSIDE the renderer sandbox (scope change) via a single crafted HTML page. Any user who browses to a malicious or compromised site is at risk, requiring only that the page load and render WebGL content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.39%), but the sandbox-escape impact and network reachability make this a high-priority patch.
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later via the Chrome Stable channel; restart the browser to complete the update (Chrome updates in the background but the new binary loads only after relaunch). Enterprises should push the release through their existing update/management tooling and confirm the version post-restart. Users of other Chromium-based browsers should apply the equivalent updated build from their vendor once available. If patching cannot be completed immediately, the most effective compensating control is to disable WebGL - for managed fleets this can be done via policy or by disabling hardware acceleration (chrome://settings) or the WebGL flags in chrome://flags - accepting the trade-off that WebGL-dependent sites and web apps (maps, 3D viewers, some games and dashboards) will break or fall back to slower software rendering. Reference advisories: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html and the Chromium issue https://issues.chromium.org/issues/529991907.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebGL is Chrome's JavaScript API for GPU-accelerated 2D/3D rendering in the browser, implemented on top of the ANGLE graphics abstraction layer and the GPU process. The flaw is classified CWE-122 (heap-based buffer overflow): attacker-controlled WebGL input (e.g., malformed geometry, texture, or draw parameters) causes a write past the bounds of a heap allocation. Because the vulnerability is reported to break out of the sandbox (CVSS scope change S:C), the corruption occurs in or is leveraged through the more-privileged GPU process rather than being confined to the sandboxed renderer, giving an attacker a path to code execution at the browser's privilege level. The affected CPE is cpe:2.3:a:google:chrome, covering all Chrome desktop builds prior to the fixed 152.0.7977.65 release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a visit (UI:R, PR:N, AC:L); sandbox escape justifies S:C and the resulting code execution yields full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical remote code execution vulnerability in Google Chrome's WebGL component allows attackers to escape the browser's security sandbox and achieve complete system access from a single malicious webpage, affecting every employee regardless of technical sophistication. With no authentication required and only normal web browsing as the attack vector, this poses enterprise-wide risk to all Chrome users and organizational systems.
Apply vendor patch: Google Chrome 152.0.7977.65 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB