Description

Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:08.203Z",
  "pubdate": "2026-08-25T21:18:08.203Z",
  "executiveSummary": "This vulnerability involves a buffer overflow flaw within the ANGLE (Almost Native Graphics Layer Engine) component utilized by Google Chrome.\nThe issue affects versions of Google Chrome prior to 152.0.7977.65.\nA remote attacker can leverage this vulnerability by enticing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution outside the browser's security sandbox.\nThe severity of this flaw is classified as High by the Chromium project, reflecting the significant risk of system compromise and potential bypass of browser isolation mechanisms.\nSuccessful exploitation allows for unauthorized code execution in the context of the user, necessitating immediate patching to maintain system integrity and security posture.",
  "technicalDetails": "The vulnerability resides in the ANGLE graphics abstraction layer, which serves as a critical interface for translating OpenGL ES calls to platform-specific graphics APIs like Direct3D, Vulkan, or Metal within the Chromium architecture.\nThe root cause is a buffer overflow condition, likely originating from improper bounds checking when processing malicious graphics commands or shaders provided by a web page.\nThe exploitation flow typically begins when a victim navigates to a malicious URL. The browser's rendering process then initiates a call to the vulnerable ANGLE component to process graphics-related data contained within the HTML/JavaScript payload.\nBy supplying a crafted sequence of inputs—specifically designed to exceed the allocated memory buffer in the ANGLE layer—an attacker can trigger a heap or stack-based buffer overflow.\nThis memory corruption permits the overwrite of adjacent control data, such as return addresses or function pointers, allowing the attacker to redirect the instruction pointer (IP) to arbitrary shellcode or a ROP (Return-Oriented Programming) chain.\nBecause the vulnerability facilitates execution outside the standard Chromium sandbox, the impact is severe. The sandbox is the primary security boundary intended to prevent malicious code from interacting with the underlying operating system or accessing sensitive user data. A sandbox escape effectively nullifies the browser's primary defense-in-depth measure.\nThe attack requires no specific authentication or elevated privileges from the user, as the exploit is triggered purely through the standard rendering pipeline during normal browser usage.\nPost-exploitation, the attacker gains the ability to execute arbitrary commands with the privileges of the Chrome process, which can lead to full system compromise, data exfiltration, or the installation of persistent malware.\nThe vulnerability affects Chromium-based ecosystems relying on the specified version of the ANGLE library, necessitating updates to both the rendering engine and the host application."
}