Description

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:07.873Z",
  "pubdate": "2026-08-25T21:18:07.873Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified within the ANGLE (Almost Native Graphics Layer Engine) component of the Google Chrome browser.\nThe issue affects versions prior to 152.0.7977.65, posing a significant security risk by allowing a remote attacker to achieve arbitrary code execution outside the browser's sandbox environment.\nThe vulnerability is classified as having a Medium security severity rating by the Chromium project. Successful exploitation requires the victim to render a specifically crafted HTML page, typically via a malicious website or advertisement.\nThe primary risk involves an attacker gaining unauthorized control over the execution flow of the browser process, which could lead to full system compromise depending on the effectiveness of the sandbox escape mechanism.\nNo authentication or specific user privileges are required to initiate the attack, as it is triggered automatically upon visiting the malicious content within the browser.",
  "technicalDetails": "The vulnerability resides within the ANGLE component, which serves as the abstraction layer for graphics API translation (e.g., mapping OpenGL ES to Direct3D or Vulkan) in Chromium-based browsers.\nThe root cause is an out-of-bounds write operation occurring within memory during graphics processing tasks. An out-of-bounds write occurs when the software performs a write operation beyond the intended boundaries of a buffer, typically caused by improper bounds checking or integer arithmetic errors during buffer index calculation.\nThe exploitation process initiates when a remote attacker delivers a crafted HTML page containing malicious WebGL or similar graphics-related instructions. As the browser parses and executes these instructions, the ANGLE component processes the input data.\nDue to the lack of sufficient validation on memory indices, the crafted input causes the engine to write data to an unintended memory location. By carefully controlling the payload, an attacker can overwrite adjacent memory structures, such as function pointers, object metadata, or return addresses on the stack.\nThe ability to overwrite critical control flow data allows the attacker to hijack the execution path. By redirecting the program counter to attacker-supplied shellcode or utilizing return-oriented programming (ROP) techniques, the attacker can execute arbitrary instructions within the context of the renderer process.\nFurthermore, the vulnerability explicitly notes the capability to execute code outside the sandbox. This suggests that the exploitation involves chaining the initial memory corruption with an auxiliary vulnerability to break out of the Chromium sandbox, enabling the attacker to impact the host operating system or escalate privileges beyond the restricted browser process.\nThe attack is considered remote as it only requires the user to load a web page, eliminating the need for local file access or elevated user interaction. The impact is significant, as it effectively bypasses the defense-in-depth measures provided by the Chromium sandbox."
}