Description

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:17:57.747Z",
  "pubdate": "2026-08-25T21:17:57.747Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified within the ANGLE graphics abstraction layer utilized by Google Chrome on Windows.\nThe vulnerability allows a remote attacker to perform unauthorized memory modifications, potentially leading to arbitrary code execution outside the browser's sandbox environment.\nAffected systems include versions of Google Chrome on Windows prior to 152.0.7977.65.\nThis high-severity flaw poses a significant risk as it can be exploited via a crafted HTML page, requiring only user interaction such as navigating to a malicious website.\nSuccessful exploitation results in the compromise of the client machine, bypassing standard sandbox protections designed to isolate browser processes from the operating system.\nGiven the nature of ANGLE as a translation layer for OpenGL ES to platform-specific APIs like Direct3D, flaws in this component are particularly dangerous due to their proximity to low-level hardware drivers and system memory.",
  "technicalDetails": "The vulnerability resides within the ANGLE (Almost Native Graphics Layer Engine) component, which serves as a critical abstraction layer for translating OpenGL ES commands into platform-specific graphics APIs, such as Direct3D 11 or 12 on Windows.\nThe root cause is an out-of-bounds write memory safety violation. This typically occurs when the engine fails to perform adequate bounds checking on inputs or indices provided during shader compilation, texture resource management, or command buffer processing.\nWhen processing malformed graphics commands, the internal state of the ANGLE library may become corrupted. If the attacker can influence the size or validation logic of buffers, they can trigger a write operation that exceeds the allocated memory region. This allows for the overwriting of adjacent heap or stack memory.\nThe attack flow begins when a remote attacker hosts a crafted HTML page containing malicious WebGL or WebGPU content. When a target user visits this page, the browser's rendering process executes the embedded malicious graphics code.\nThe crafted payload exploits the ANGLE layer by submitting specific command sequences designed to bypass size validation. By overwriting function pointers, return addresses, or objects within the heap, the attacker can hijack the control flow of the rendering process.\nBecause the ANGLE component operates within the browser's renderer process, this exploit acts as a stepping stone for sandbox escape. By chaining the out-of-bounds write with secondary vulnerabilities or primitive exploits, an attacker can elevate their execution privileges to gain arbitrary code execution context outside the sandboxed rendering environment.\nThe reliance on ANGLE's complex state management makes it a high-value target for memory corruption attacks. Since the vulnerability is reachable through standard web technologies (HTML/JavaScript/WebGL), the attack surface is broad, encompassing any user who can be coerced into rendering malicious content in a vulnerable Chrome instance.\nThe absence of sufficient integrity checks on the graphics memory buffers enables the attacker to manipulate the process memory layout to facilitate stable exploit execution, ultimately leading to full system compromise if the sandbox is successfully bypassed."
}