EUVD-2026-65811
GHSA-c8v3-xpmq-f63m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted page
-
DeliveryDeliver malicious WebGL/HTML content
-
ExploitTrigger use-after-free in ANGLE
-
ExecutionReclaim freed memory with controlled data
-
PersistExecute code and escape sandbox
-
ImpactCompromise host beyond browser
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled HTML/WebGL content in a vulnerable Chrome build below 152.0.7977.65 - the UI:R metric means user interaction (navigating to or opening the crafted page) is mandatory, which is the primary limiting factor. No authentication is required (PR:N, unauthenticated remote attacker) and attack complexity is low (AC:L). The specific technical prerequisite is that the crafted page must exercise the vulnerable ANGLE graphics code path, so environments where WebGL/hardware graphics acceleration is disabled make the vulnerable code harder to reach. There is no dependency on non-default configuration otherwise; standard Chrome installs with default WebGL enabled are exposed. |
| Impact | The signals are partly divergent and must be weighed together. CVSS 3.1 is 9.6 (Critical) driven by AV:N/AC:L/PR:N with only UI:R and a scope change from sandbox escape - technically a very dangerous, low-complexity, unauthenticated remote bug. SSVC lists Exploitation: none and Automatable: no, but Technical Impact: total, confirming full compromise potential if exploited. EPSS is low at 0.41% (34th percentile), and there is no KEV listing and no public POC, indicating exploitation is not yet occurring or widespread. The reconciling interpretation: this is a high-severity, high-impact vulnerability that is currently NOT under active exploitation, so its real-world priority derives from Chrome's ubiquity and the ease of mass web-based delivery rather than from evidence of in-the-wild use. Because it requires user interaction (visiting a page) and is not automatable per SSVC, it is a strong patch-now candidate but not an emergency zero-day. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted WebGL/graphics content and entices a victim on a vulnerable Chrome build to visit it (via phishing link, malvertising, or watering hole). Rendering the page triggers the use-after-free in ANGLE, and by grooming freed memory the attacker achieves code execution that escapes the renderer sandbox into a more privileged context. No public exploit is identified at time of analysis, so this reflects capability implied by CVSS AV:N/AC:L/UI:R rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the browser sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated 9.6/Critical with a scope change, meaning exploitation impacts the host beyond the compromised renderer. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the EPSS score of 0.41% reflects only near-term probability, not the true severity of a sandbox-escaping RCE.
RemediationAI
Vendor-released patch: 152.0.7977.65 - upgrade Google Chrome to 152.0.7977.65 or later on all desktop platforms and restart the browser to load the fix, per Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). In managed environments, force the update through enterprise policy and verify the effective version rather than relying on background auto-update, which may lag. As an interim compensating control before patching, you can reduce the ANGLE/WebGL attack surface by disabling hardware acceleration or WebGL (chrome://settings 'Use graphics acceleration when available', or policy) so the vulnerable graphics path is less readily reached - the trade-off is degraded rendering/GPU performance and broken WebGL content. Restricting browsing to trusted sites and enforcing user-interaction awareness reduces the delivery opportunity but does not remove the bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates WebGL and OpenGL ES calls onto the platform's native graphics backend (Direct3D, Metal, Vulkan, or desktop GL). Because it processes untrusted GPU/WebGL commands originating from web content, memory-safety bugs here are directly reachable from a web page. The root cause is CWE-416 use-after-free: a memory object is freed but a dangling reference is subsequently used, allowing an attacker to reclaim that memory with controlled data and corrupt program state. Notably the description states code execution occurs 'outside the sandbox,' consistent with ANGLE code paths that run with elevated privilege relative to the renderer, which is why CVSS assigns S:C (scope change). Affected CPE is cpe:2.3:a:google:chrome across all versions below the fixed build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Web-delivered UAF reachable unauthenticated (AV:N/PR:N) with low complexity but requiring the victim to open a page (UI:R); sandbox escape yields S:C and full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions prior to 152.0.7977.65 contain a critical use-after-free vulnerability in the ANGLE graphics component enabling remote code execution with sandbox escape. Exploitation requires only that users visit a crafted webpage, allowing attackers to execute arbitrary code on affected systems and potentially access credentials, intellectual property, and sensitive business data stored locally or in browser memory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB