EUVD-2026-65979
GHSA-p6h6-mmg4-qj75
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Sandbox escape constitutes a scope change (S:C); all other metrics reflect network delivery via a crafted page requiring only passive user navigation.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running Google Chrome on Windows-the vulnerability is explicitly platform-specific and does not affect Chrome on Linux or macOS-in any version prior to 152.0.7977.65. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects high network-exploitable severity with low attack complexity and no privilege requirements, but the EPSS score of 0.35% at the 28th percentile is notably low for a high-CVSS vulnerability, and SSVC classifies exploitation as 'none' with automatable set to 'no'-these signals together indicate no observed mass exploitation or publicly weaponized exploit at time of analysis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page containing specially constructed graphics or WebGL content designed to trigger the out-of-bounds read in Chrome's ANGLE engine during rendering. A Windows user browsing to this page in an unpatched Chrome version triggers the memory corruption, which the attacker chains into code execution outside the Chrome renderer sandbox. … |
| Remediation | Update Google Chrome on Windows to version 152.0.7977.65 or later as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert Chrome users on Windows systems of the patch requirement and identify all affected installations through your device inventory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today