Description

Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:55.200Z",
  "pubdate": "2026-08-25T21:17:55.200Z",
  "executiveSummary": "A high-severity out-of-bounds read vulnerability has been identified within the ANGLE (Almost Native Graphics Layer Engine) component of the Google Chrome browser on Windows.\nThe vulnerability occurs due to improper bounds checking during graphics processing, which can be leveraged by a remote attacker to achieve arbitrary code execution outside the browser's security sandbox.\nAffected systems include Google Chrome on Windows versions prior to 152.0.7977.65.\nSuccessful exploitation allows a remote attacker to compromise the host system by providing a specially crafted HTML page that induces an out-of-bounds memory access.\nThis flaw presents significant risk as it bypasses standard browser isolation mechanisms, potentially granting the attacker persistence or system-level control over the affected Windows environment.\nNo authentication or specific user privileges are required for exploitation, as the attack is initiated through common web-based interaction.",
  "technicalDetails": "The vulnerability resides within the ANGLE graphics abstraction layer, a critical component of the Chromium project used to translate OpenGL ES calls into platform-specific graphics APIs such as Direct3D on Windows.\nThe root cause is an out-of-bounds (OOB) read condition, where the rendering engine fails to adequately validate the boundaries of memory buffers when processing untrusted graphical input provided by a remote attacker.\nWhen a user navigates to a malicious HTML page, the attacker can leverage WebGL or other graphics-intensive APIs to inject payloads that manipulate internal state variables within the ANGLE library. By inducing an OOB read, an attacker can access memory segments outside the allocated heap or stack boundaries associated with the rendering process.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious HTML document containing specifically tuned WebGL shaders or vertex buffer objects. Second, the browser's rendering process executes these requests, triggering the vulnerable path within the ANGLE library. Third, the OOB read operation enables the attacker to leak sensitive memory information, which serves as a primitive to calculate address space layout randomization (ASLR) offsets or to manipulate pointers directly.\nOnce the attacker successfully gains an OOB read capability, they can bypass the browser's sandbox environment. By corrupting internal data structures or function pointers in memory, the attacker can redirect the control flow to arbitrary code residing in memory. Because the rendering process operates with specific Windows platform permissions, achieving code execution here allows the attacker to break out of the sandbox and execute commands with the privileges of the Chrome process.\nThis vulnerability is particularly critical because it bypasses the primary security layer of Chromium—the sandbox. The exploit does not require the attacker to compromise the underlying operating system directly; rather, it exploits the interface between the web content and the host graphics driver. Once outside the sandbox, the attacker may perform further post-exploitation actions, such as escalating privileges, exfiltrating user data, or installing persistent malicious software on the Windows host.\nThe vulnerability affects Chromium-based browsers on Windows versions older than 152.0.7977.65."
}