EUVD-2026-65809
GHSA-jj5q-p92r-vcc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryDeliver malicious graphics content to ANGLE
-
ExploitTrigger out-of-bounds write in GPU process
-
ExecutionCorrupt memory to hijack control flow
-
PersistExecute arbitrary code outside sandbox
-
ImpactCompromise host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or be redirected to an attacker-controlled HTML page in a vulnerable Chrome build (before 152.0.7977.65) - UI:R means user interaction (visiting/rendering the page) is mandatory, and no authentication is needed (PR:N). The specific trigger is crafted web content that reaches Chrome's ANGLE graphics layer (WebGL/GPU rendering path), so environments that disable hardware acceleration or WebGL materially reduce reachability. Limiting factors: it is not a zero-click bug (the user must load the malicious content), it is patched in current Stable, and there is no evidence of active exploitation or public exploit code; the value is high because a single scope-changing bug yields code execution outside the renderer sandbox. |
| Impact | Signals are mixed but lean toward high priority for a browser. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects network-reachable, low-complexity, unauthenticated exploitation that only requires the victim to open a page, with a scope change to the host from the sandbox escape. Countering that, EPSS is low at 0.30% (22nd percentile) and the CVE is NOT on CISA KEV, and no POC is referenced - so there is no evidence of active or imminent exploitation yet. Google labels the Chromium severity 'High' rather than 'Critical', consistent with a bug that needs user interaction. Net: the ceiling is severe (unauth sandbox-escape RCE in a ubiquitous browser), but current real-world exploitation likelihood is low; treat as a standard-cadence but not emergency patch, prioritized upward for high-risk/targeted user populations. No conflicting metrics were observed; the main unknown is whether a working exploit exists privately. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted graphics content that triggers the ANGLE out-of-bounds write, then drives a target to it via phishing, a malicious ad, or a watering-hole site. When the victim's pre-152.0.7977.65 Chrome renders the page, the memory corruption is triggered in ANGLE and, upon successful exploitation, runs attacker code outside the browser sandbox on the host. No public POC or in-the-wild exploitation is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome (desktop, versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/Direct3D graphics translation layer. A remote attacker who lures a user to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving native code execution on the host. Rated CVSS 9.6 with a scope change; no public exploit is identified at time of analysis and EPSS is low (0.30%, 22nd percentile), though ANGLE/GPU bugs are historically attractive to attackers.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Chrome to 152.0.7977.65 or later on all desktop platforms and restart the browser to apply it (verify via chrome://settings/help); managed fleets should push the update through their enterprise management/auto-update channel per https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Users of Chromium-based browsers should apply the equivalent vendor update once available. As an interim compensating control before patching, reduce GPU attack surface by disabling hardware acceleration (Settings → System → 'Use graphics acceleration when available' off, or the #ignore-gpu-blocklist / GPU flags), which forces software rendering and shrinks the ANGLE path - trade-off is degraded rendering/WebGL performance and it is not a guaranteed block. Disabling WebGL (chrome://flags or enterprise policy) further limits attacker-controlled graphics commands but breaks WebGL-dependent sites. These are stopgaps only; patching is the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the graphics abstraction that maps WebGL/OpenGL ES calls onto the platform's native GPU API (Direct3D on Windows, Metal on macOS, Vulkan/GL on Linux). It processes attacker-influenceable rendering commands from web content and, on many platforms, runs in the GPU process, which is less strongly sandboxed than the renderer. The flaw is CWE-787 (Out-of-bounds Write): a length/bounds miscalculation while handling crafted graphics operations lets the code write past an allocated buffer, corrupting adjacent memory and enabling control-flow hijack. Because the corruption occurs in ANGLE rather than the sandboxed renderer, successful exploitation reaches code execution outside the sandbox. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome browser itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N), victim must visit it (UI:R), and code runs outside the sandbox (S:C) with full host C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome desktop versions prior to 152.0.7977.65 contain a critical sandbox-escape vulnerability enabling remote code execution via malicious webpages. An attacker can bypass Chrome's sandbox protections to execute arbitrary code at the operating system level, directly compromising any user who visits a crafted site. All Chrome desktop users in the organization are at risk; remediation is urgent despite currently low exploitation prevalence.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB