Description

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:18:27.390Z",
  "pubdate": "2026-08-18T21:18:27.390Z",
  "executiveSummary": "This vulnerability is a critical buffer overflow flaw affecting the WebGL component in Google Chrome prior to version 151.0.7922.169.\nThe security defect allows a remote attacker to achieve arbitrary code execution outside of the browser sandbox infrastructure.\nExploitation requires a victim to load a specially crafted HTML page designed to interact maliciously with the vulnerable WebGL implementation.\nSuccessful exploitation poses severe risk implications, as escaping the sandbox compromises the underlying host operating system and compromises user data integrity and device confidentiality.\nThe attack vector is network-based via web content, requiring user interaction to visit the malicious page, with no prior authentication or local privileges necessary for the remote attacker.",
  "technicalDetails": "The vulnerability resides within the WebGL graphics processing subsystem of Google Chrome, specifically involving memory management and boundary checks prior to version 151.0.7922.169.\nThe root cause stems from a buffer overflow condition where input data provided through a crafted HTML page exceeds the allocated memory boundaries of a specific buffer in the WebGL component.\nExploitation occurs when an attacker delivers malicious content via a remote web page, manipulating WebGL API calls and shader or texture data processing to trigger memory corruption.\nThe attack flow begins when the target user navigates to the attacker-controlled URL using an unpatched instance of Google Chrome.\nThe browser parses the malicious HTML and executes the embedded JavaScript and WebGL instructions, which trigger the buffer overflow within the rendering engine.\nBy carefully crafting the payload, the attacker overwrites adjacent memory structures, bypassing browser security controls and the Chromium sandbox architecture.\nOnce the sandbox boundary is breached, the attacker can execute arbitrary code with the privileges of the user process, leading to full system compromise or persistence on the host machine.\nThe vulnerability requires no authentication or special privileges, exposing any user browsing untrusted websites to remote exploitation if running an affected version."
}