Description

Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T21:17:48.010Z",
  "pubdate": "2026-08-25T21:17:48.010Z",
  "executiveSummary": "A race condition vulnerability exists within the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser's sandbox environment.\nThe vulnerability is triggered by a crafted HTML page designed to exploit synchronization primitives or memory management inconsistencies within the graphics abstraction layer. By leveraging the race condition, an attacker can manipulate shared state or memory operations before the engine correctly enforces thread safety or bounds checking.\nThe impact is significant, as successful exploitation enables an attacker to escape the Chromium sandbox, potentially leading to unauthorized system access, data exfiltration, or complete host compromise.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65. Exploitation requires user interaction, typically involving the victim visiting a malicious website controlled by the attacker. Given the severity of sandbox escapes, this issue poses a critical threat to user security, as it bypasses the primary security boundary of the web browser architecture.",
  "technicalDetails": "The vulnerability is rooted in a race condition within the ANGLE graphics abstraction layer, which serves as a compatibility layer between OpenGL ES and various platform-specific graphics APIs (DirectX, Vulkan, Metal). The race condition occurs when the browser's renderer process handles graphics commands derived from web content.\nIn a multi-threaded graphics rendering environment, correct synchronization is essential to ensure that resource management, command buffer updates, and state transitions occur atomically. If the implementation of these synchronization mechanisms is flawed, a window of opportunity exists between the verification of a resource state and its actual utilization. An attacker can use a specially crafted HTML page—utilizing WebGL or WebGPU contexts—to submit high-frequency or interleaved graphics commands that induce a contention state within the ANGLE library.\nExploitation proceeds through the manipulation of the internal state machine of the rendering engine. By carefully timing the execution of rendering calls, an attacker forces a race between a thread performing a validity check (e.g., verifying a buffer pointer or memory allocation) and a thread modifying that same underlying resource. When the race is won by the attacker, the validation check succeeds, but the subsequently executed operation acts upon stale, corrupted, or re-allocated memory.\nThis leads to memory safety violations such as Use-After-Free (UAF) or Out-of-Bounds (OOB) access within the context of the renderer process. Once memory corruption is achieved, the attacker can redirect the execution flow to a controlled payload, such as a ROP (Return-Oriented Programming) chain. By chaining primitives, the attacker targets components responsible for IPC (Inter-Process Communication) between the renderer and the browser process. Successfully exploiting the race condition allows the attacker to execute arbitrary code with the privileges of the renderer, and subsequently leverage vulnerabilities in the IPC interface to bypass sandbox restrictions and achieve code execution on the underlying host operating system.\nThe vulnerability affects Chromium-based browsers utilizing ANGLE prior to version 152.0.7977.65. Authentication is not required, as the exploit is delivered remotely via web content. The attack vector is strictly client-side, necessitating that the attacker convince a user to navigate to a malicious URL to trigger the vulnerable rendering path."
}