EUVD-2026-65803
GHSA-xm9j-86vv-2j8r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryMalicious WebGL content reaches ANGLE
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionCorrupt memory to escape sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or be redirected to attacker-controlled HTML in a vulnerable Chrome build (prior to 152.0.7977.65) - this is the UI:R user-interaction prerequisite. No authentication and no special privileges are needed (PR:N), and default Chrome configurations are exploitable because ANGLE/WebGL graphics processing is enabled by default. Limiting factors: the user must actually visit the malicious page (no zero-click), the browser must be unpatched, and reliable code execution outside the sandbox typically requires defeating modern memory mitigations (ASLR, etc.), which raises the practical bar despite the low CVSS complexity rating. Disabling hardware acceleration/WebGL would materially reduce exposure. |
| Impact | The signals are mixed but lean toward treating this as a high-priority browser patch. CVSS 3.1 is 9.6 driven by network vector, low complexity, no privileges, and a scope change reflecting sandbox escape - the worst-case profile for a client-side bug - tempered only by UI:R, since the victim must open a malicious page. Against that, EPSS is just 0.30% (22th percentile) and the CVE is not on CISA KEV, so there is no evidence of active or imminent mass exploitation yet; the low EPSS is consistent with a freshly disclosed, already-patched browser bug rather than a low-risk one. There is no indication of public POC code. On balance this is a genuine priority for any organization running Chrome at scale because browsers are a primary drive-by attack surface and sandbox escapes are prized by exploit developers, even if opportunistic exploitation has not yet materialized; standard Chrome auto-update makes remediation cheap, so there is little reason to defer it. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/graphics content and lures a Chrome user to it via phishing, a malvertising ad, or a compromised site. When the page renders, it drives ANGLE into an out-of-bounds write, corrupting memory to potentially execute code beyond the browser sandbox on the victim's machine. Given low attack complexity but a required user visit (UI:R) and no known public POC, this fits a drive-by/watering-hole model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger an out-of-bounds write and potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.30%, 22th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on all desktop platforms; this is the primary and sufficient remediation. Most installations receive this automatically via Chrome's background updater, so verify the running version under chrome://settings/help and relaunch to apply, and in managed fleets push the update through your management tooling and force a browser restart to ensure the new binary is loaded. Refer to Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html) for channel details. If patching must be briefly delayed, compensating controls include disabling hardware-accelerated GPU/WebGL (chrome://settings 'Use graphics acceleration when available' off, or the --disable-webgl / policy equivalents) to reduce ANGLE's attack surface - with the trade-off of degraded rendering performance for graphics-heavy sites - and restricting untrusted web browsing via web filtering; note these are stopgaps only and do not fully close the bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL/OpenGL ES calls onto the host's native graphics API (Direct3D, Metal, Vulkan, or desktop GL). Because ANGLE processes attacker-influenced GPU command streams and often runs in the GPU process - which is less strictly sandboxed than the renderer - memory-safety bugs here are especially dangerous. The root cause is CWE-787 (Out-of-bounds Write): a crafted page drives ANGLE to write past the bounds of an allocated buffer, corrupting adjacent memory. The CVSS scope change (S:C) and the description's 'outside the sandbox' phrasing indicate the corruption can be leveraged beyond the confines of the exploited component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N, AC:L, PR:N) needs the user to visit it (UI:R); sandbox escape justifies S:C with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome contains a critical vulnerability affecting all desktop users that allows remote code execution when victims visit a malicious webpage. This sandbox-escape flaw could enable attackers to bypass security controls and potentially access sensitive corporate data, user credentials, and internal systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB