Description

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:00.023Z",
  "pubdate": "2026-08-25T21:18:00.023Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability exists within the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome prior to version 152.0.7977.65.\nThis vulnerability is classified as a high-severity security flaw that permits a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox.\nThe flaw stems from insufficient memory bounds checking during graphics processing, which can be triggered by a maliciously crafted HTML page.\nSuccessful exploitation compromises the integrity of the user's environment by enabling remote code execution (RCE).\nGiven the nature of the browser's sandbox architecture, the ability to escape this containment signifies a significant risk, potentially leading to full system compromise depending on the user's privilege level and host platform security configurations.\nExploitation requires no user authentication but depends on the victim interacting with a compromised or malicious web resource designed to trigger the specific memory corruption state.",
  "technicalDetails": "The vulnerability resides in the ANGLE graphics abstraction layer, which serves as a critical bridge between browser-based graphics requests and underlying platform-specific APIs like Direct3D, OpenGL, or Vulkan. The root cause is identified as an out-of-bounds (OOB) write, implying that the component fails to correctly validate the size or indices of data buffers during graphics command processing.\nWhen a web page supplies a maliciously crafted shader or specific graphics operation, the ANGLE engine may attempt to write data to a memory location outside the intended buffer boundaries. This memory corruption occurs due to an integer overflow or a lack of bounds verification during the processing of complex graphics state updates or buffer allocations within the GPU driver interface.\nThe attack flow begins when a user navigates to an attacker-controlled HTML page. The page utilizes JavaScript or WebGL APIs to interact with the ANGLE subsystem. By triggering a specific sequence of graphics calls, the attacker forces the engine to perform an out-of-bounds write to heap-allocated memory. This operation can be weaponized to overwrite adjacent object pointers, function pointers, or critical control data within the process memory space.\nBy achieving control over memory layout or overwriting control-flow structures, the attacker can redirect the execution flow of the Google Chrome process. Because the underlying vulnerability occurs within the graphics pipeline, it bypasses standard sandboxing mechanisms that typically isolate web content from the underlying operating system. Once execution flow is hijacked, the attacker can execute arbitrary shellcode or perform ROP (Return-Oriented Programming) chains to gain elevated code execution privileges.\nThe vulnerability affects all Google Chrome versions prior to 152.0.7977.65. The exploit is remote and network-based, as the browser processes the malicious content automatically once the page is rendered. There is no requirement for the attacker to have pre-existing privileges on the host system, making it an ideal target for drive-by download attacks. Post-exploitation, the impact ranges from sensitive data exfiltration and persistent malware installation to full system takeover, depending on the scope of the browser's access to host resources."
}