Description

Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:47.747Z",
  "pubdate": "2026-08-25T21:17:47.747Z",
  "executiveSummary": "A critical type confusion vulnerability exists within the ANGLE graphics abstraction layer used by Google Chrome. This flaw allows a remote attacker to achieve arbitrary code execution beyond the confines of the browser sandbox by enticing a user to visit a specially crafted HTML page. The vulnerability affects Google Chrome versions prior to 152.0.7977.65. Due to the high severity rating, successful exploitation grants an attacker the ability to bypass security boundaries, potentially leading to full system compromise depending on the effectiveness of the underlying operating system's security controls. The primary risk involves memory corruption resulting from improper handling of object types during graphics processing. Exploitation requires minimal user interaction, typically involving navigation to a malicious resource. Given the nature of type confusion, it is likely that sophisticated threat actors could weaponize this to gain persistent access or exfiltrate sensitive user data.",
  "technicalDetails": "The vulnerability originates within the ANGLE (Almost Native Graphics Layer Engine) component, which is integrated into the Chromium codebase to translate OpenGL ES API calls into platform-specific graphics APIs like Direct3D, Vulkan, or Metal. Type confusion vulnerabilities typically occur when the engine fails to enforce strict type checking on objects during complex operations, such as command buffer processing or resource management within the graphics pipeline.\nIn this specific instance, the issue manifests when the ANGLE engine misidentifies an object's type during execution. An attacker can leverage a crafted HTML page containing malicious WebGL or WebGPU instructions to trigger the browser's graphics rendering path. By supplying specifically formatted shaders or buffer data, the attacker forces the engine to treat a data structure as an unintended type. This discrepancy allows for an out-of-bounds memory read or write operation.\nThe attack flow follows a structured path: First, the attacker hosts a malicious HTML page that invokes specific browser graphics APIs designed to stress the ANGLE component. Second, the crafted input is processed by the renderer process, where the type confusion is triggered during the validation or translation phase of the graphics commands. Third, the resulting memory corruption provides the attacker with primitives to manipulate pointers or overwrite function pointers within the process's memory space.\nOnce the attacker achieves control over the instruction pointer or the state of sensitive objects, they can execute arbitrary code within the context of the renderer process. By chaining this primitive with a sandbox escape technique, the attacker can break out of the Chromium renderer sandbox to execute arbitrary code on the underlying host operating system. The vulnerability is particularly dangerous because it bypasses standard memory safety mechanisms inherent in the browser architecture by operating at the lower-level abstraction layer where direct interaction with graphics hardware drivers is frequent.\nAffected versions include all Google Chrome releases prior to 152.0.7977.65. As the vulnerability is triggered via the rendering engine, exploitation does not require prior authentication or elevated privileges, provided the attacker can convince the user to interact with the malicious web content. The persistent risk post-exploitation includes unauthorized data access, the deployment of secondary payloads, and complete host compromise."
}