EUVD-2026-65812
GHSA-r56v-54j8-9pfx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim opens crafted HTML page
-
DeliveryMalicious content invokes ANGLE GPU path
-
ExploitTrigger out-of-bounds write in ANGLE
-
ExecutionCorrupt memory to hijack control flow
-
PersistEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on Windows at a version below 152.0.7977.65 and to actively open attacker-controlled content - the CVSS UI:R and the 'crafted HTML page' language both confirm required user interaction, so this cannot be triggered fully unattended. No authentication is required (PR:N) and no special server-side configuration is needed; the vulnerable ANGLE/GPU rendering path is reachable in default Chrome installations. The primary limiting factors are: the need to lure the user to malicious content, platform specificity (Windows), and the version ceiling - patched (152.0.7977.65+) builds are not affected. Reliable code execution also depends on defeating Chrome's exploit mitigations, which is non-trivial though not reflected in the base CVSS score. |
| Impact | Signals are mixed but lean toward prioritized patching. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) is severe: network-reachable, low complexity, no privileges, and a scope change reflecting sandbox escape - the most dangerous class of browser bug. Countervailing that, EPSS is low (0.25%, 16th percentile), the issue is not on CISA KEV, and no public exploit has been identified, so this is not evidence of active or imminent mass exploitation. The one hard prerequisite is user interaction (UI:R) - a victim must open attacker-controlled content - which modestly reduces automatability. Given Chrome's enormous install base, a sandbox-escape RCE warrants urgent deployment of the fixed build regardless of the currently low EPSS, since browser N-day bugs are frequently reverse-engineered from patches shortly after release. Treat the low EPSS as 'no known exploitation yet,' not as 'safe to defer.' |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted content that exercises the vulnerable ANGLE graphics code path and sends the link via phishing, malvertising, or a compromised site. When a Windows user running a pre-152.0.7977.65 Chrome build visits the page, the out-of-bounds write corrupts memory and can lead to code execution outside the renderer sandbox. No public exploit has been identified at time of analysis, so this reflects the potential impact rather than an observed campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Google Chrome to 152.0.7977.65 or later on Windows via the Chrome Stable channel and restart the browser to apply it (verify via chrome://settings/help). In managed environments, push the update through your enterprise deployment mechanism and confirm the version to close the window before patches are reverse-engineered. If immediate patching is not possible, a targeted compensating control is to disable hardware-accelerated GPU rendering (chrome://settings → System → 'Use graphics acceleration when available' off, or the HardwareAccelerationModeEnabled=false policy), which reduces exposure of the ANGLE graphics path at the cost of degraded rendering performance and some broken WebGL/GPU-dependent sites; this is a stopgap, not a substitute for the update. Advisory: https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) translates Chrome's WebGL/GPU calls onto native backends (on Windows, typically Direct3D), and it runs in a position where a memory-safety error can bridge from the sandboxed renderer toward the host. The flaw is CWE-787 (Out-of-bounds Write): attacker-influenced data drives a write past the bounds of an allocated buffer, corrupting adjacent memory and enabling control-flow hijack. Because the affected code path is reachable from web content via GPU/graphics processing, a malicious page can trigger it without local access. The single CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirms the affected product is the Chrome application itself, with the description scoping impact specifically to the Windows platform.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs no privileges (PR:N) but requires the user to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with full RCE impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical sandbox-escaping remote code execution vulnerability in Google Chrome for Windows (versions prior to 152.0.7977.65) allows attackers to bypass browser protection mechanisms and execute arbitrary code on Windows devices through malicious webpages. This threatens the security posture of all organizations with Windows users browsing the internet, potentially exposing sensitive data and enabling system compromise. Immediate patching is essential as the vulnerability requires only social engineering to exploit.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB