EUVD-2026-65797
GHSA-68fh-3p9q-6hq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage issues malicious WebGL/GPU commands
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionCorrupt memory to hijack control flow
-
PersistEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or be redirected to an attacker-controlled crafted HTML page in a vulnerable Chrome build (before 152.0.7977.65) - this user interaction (UI:R) is the primary limiting factor. There is no authentication requirement (PR:N) and no special configuration beyond a Chrome instance with graphics/WebGL rendering active, which is default. The page must trigger the vulnerable ANGLE graphics code path to cause the out-of-bounds write, and reliable code execution depends on defeating Chrome's sandbox and memory mitigations (ASLR), which raises practical difficulty despite the low CVSS attack complexity. |
| Impact | The signals partly conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates a network-reachable, low-complexity, unauthenticated bug whose only gate is user interaction, with a scope change consistent with a sandbox escape - a genuinely severe profile. Against that, EPSS is only 0.35% (28th percentile), the CVE is not on CISA KEV, and no POC is referenced, so real-world exploitation is not yet evidenced. This is characteristic of freshly disclosed Chrome memory bugs: high theoretical severity due to sandbox-escape potential, but no confirmed weaponization at disclosure. Net: treat as a real, high-priority patch given browser ubiquity and code-execution-outside-sandbox impact, while recognizing active exploitation is not currently confirmed. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted WebGL/graphics content and lures a victim to visit it via a phishing link, malvertising, or a compromised site. When the page renders, the ANGLE out-of-bounds write corrupts memory and is chained to escape the renderer sandbox and run attacker code on the host. No public POC is referenced at time of analysis, and success requires the victim to actually open the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Google Chrome to 152.0.7977.65 or later on the Stable channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). Chrome normally auto-updates, so restart the browser to apply a downloaded update and verify via chrome://settings/help; in managed environments push the update through endpoint management or enterprise policy. As an interim compensating control before patching, reduce exposure by disabling hardware acceleration / WebGL so the ANGLE code path is less readily reached - this degrades graphics performance and does not fully eliminate the code path, so it is only a stopgap. Chromium-based browsers (Edge, Brave, etc.) should be updated once their vendors ship the corresponding rebase.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the component Chrome uses to translate WebGL/OpenGL ES calls from web content into the host platform's native graphics API - Direct3D on Windows, Metal on macOS, Vulkan/GL on Linux. Because it processes attacker-influenced GPU commands and runs with more privilege than the renderer sandbox, a memory-safety bug here is especially dangerous. The root cause is CWE-787 (Out-of-bounds Write): code writes past the bounds of an allocated buffer, corrupting adjacent memory that can be leveraged for control-flow hijacking. The affected CPE is cpe:2.3:a:google:chrome, i.e. the desktop Chrome browser across platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); sandbox escape changes scope (S:C) enabling full host code execution (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 152.0.7977.65 contain a critical memory-corruption vulnerability in the ANGLE graphics layer that enables attackers to break out of the browser sandbox and execute arbitrary code on affected systems. This vulnerability requires a user to visit a malicious webpage, putting all Chrome desktop users at risk of complete system compromise if exploited.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB