Description

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:00.583Z",
  "pubdate": "2026-08-25T21:18:00.583Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write within the ANGLE graphics engine component of Google Chrome on Windows.\nThe flaw allows a remote attacker to achieve arbitrary code execution within the restricted Chromium sandbox environment.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65.\nBy leveraging a specially crafted HTML page, an attacker can trigger memory corruption through the ANGLE component, potentially compromising the browser's integrity.\nSuccessful exploitation requires user interaction—specifically, the navigation to a malicious webpage—but does not require prior authentication or elevated privileges.\nGiven the ability to execute arbitrary code within the sandbox, the risk implication is high, as it serves as a critical primitive for further sandbox escape attacks or system compromise.",
  "technicalDetails": "The vulnerability exists within the ANGLE (Almost Native Graphics Layer Engine) component of the Chromium browser architecture on the Windows platform.\nAn out-of-bounds write occurs when the application attempts to write data beyond the allocated buffer boundaries of a memory region managed by ANGLE. In this specific instance, the issue likely stems from insufficient validation of inputs during the processing of graphics-related commands, such as shader compilation or texture buffer operations.\nThe attack flow initiates when a victim navigates to a malicious HTML page controlled by the attacker. This page utilizes JavaScript to interact with the browser's WebGL or WebGPU APIs, which interface directly with the ANGLE graphics translation layer.\nBy providing malformed or precisely crafted graphics commands to the ANGLE implementation, an attacker can trigger a state where the application writes data to an incorrect memory location.\nSince ANGLE operates within the renderer process, this memory corruption allows the attacker to manipulate objects residing in the renderer's heap. This manipulation is typically used to overwrite function pointers, virtual method tables (vtable), or data structures that control program flow.\nOnce the attacker successfully overwrites critical memory structures, they can redirect the execution flow to malicious shellcode or execute Return-Oriented Programming (ROP) chains. This results in arbitrary code execution within the context of the renderer process.\nBecause the renderer process is confined by the Chromium sandbox, the attacker’s code is restricted from direct system access. However, this level of execution provides a foothold for the attacker to potentially chain further vulnerabilities—such as kernel-mode exploits or sandbox escapes—to achieve complete system compromise.\nThe vulnerability is limited to the Windows platform, suggesting that the root cause may involve platform-specific implementations of the graphics drivers or how ANGLE interacts with the underlying DirectX or Vulkan abstractions on Windows."
}