Description

Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:17:54.207Z",
  "pubdate": "2026-08-25T21:17:54.207Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read within the ANGLE graphics abstraction layer integrated into Google Chrome on Windows.\nThe flaw allows a remote attacker to achieve arbitrary code execution beyond the confines of the browser sandbox through a specially crafted HTML page.\nAffected versions include Google Chrome on Windows prior to 152.0.7977.65.\nThe severity is classified as Medium by Chromium due to the requirement for specific exploitation conditions to move from an out-of-bounds read to code execution.\nBy leveraging this memory safety issue, an attacker can bypass browser-level security controls, potentially leading to unauthorized data access or system compromise if subsequent chaining occurs.\nSuccessful exploitation requires the victim to render malicious content within the browser, making this a high-risk vector for web-based attacks.",
  "technicalDetails": "The vulnerability resides in the ANGLE (Almost Native Graphics Layer Engine) component, which is used by Chromium to translate OpenGL ES API calls into platform-specific graphics APIs like Direct3D on Windows.\nThe root cause is an out-of-bounds read condition, typically occurring when the engine fails to perform adequate bounds checking on data structures or buffers passed during graphics processing tasks.\nAn attacker triggers this by delivering a crafted HTML page containing malicious WebGL or WebGPU calls. These calls manipulate the underlying graphics driver state or memory buffers processed by the ANGLE library.\nWhen the engine processes malformed input, it may attempt to access memory locations beyond the allocated buffer boundaries. In an out-of-bounds read scenario, sensitive information, pointer addresses, or heap metadata may be leaked.\nWhile an out-of-bounds read is primarily an information disclosure primitive, in the context of the ANGLE-to-D3D translation layer, it can be weaponized to bypass Address Space Layout Randomization (ASLR) and facilitate memory corruption chains.\nBy chaining this vulnerability with other memory safety flaws, an attacker can escalate the read primitive into a controlled write or execution flow, eventually triggering code execution outside the Chrome sandbox.\nThe attack flow follows a sequential pattern: 1) The user navigates to a malicious site; 2) The site executes complex, malformed graphics shader code or API calls that interface with the ANGLE module; 3) The ANGLE module performs an OOB read on internal buffers due to improper index validation; 4) The attacker observes the leaked memory to calculate offsets; 5) Subsequent memory corruption exploits are executed, bypassing the sandbox and executing arbitrary code at the process privilege level.\nThis vulnerability is particularly dangerous because ANGLE operates at a low level of the graphics stack, often communicating directly with the Windows display driver, which can lead to privilege escalation if the sandbox containment is breached.\nThe flaw affects the Windows platform specifically, as this is where the ANGLE-to-D3D bridge is primarily exercised, necessitating patching of the entire browser suite to update the library dependencies."
}