Description

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:08.337Z",
  "pubdate": "2026-08-25T21:18:08.337Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability has been identified within the ANGLE graphics abstraction layer utilized by Google Chrome.\nThis flaw allows a remote attacker to achieve arbitrary code execution beyond the confines of the browser sandbox by processing a maliciously crafted HTML page.\nThe vulnerability affects versions of Google Chrome prior to 152.0.7977.65.\nThe severity is classified as High, posing a significant risk to user systems due to the potential for complete system compromise if the sandbox is successfully bypassed.\nSuccessful exploitation requires the victim to navigate to a site hosting the malicious payload, which triggers the memory corruption error during graphics rendering operations.\nGiven the nature of the flaw in the ANGLE component, it permits an attacker to transition from a web-based attack vector to executing arbitrary machine code with escalated privileges relative to the browser process.\nImmediate patching is required to neutralize the threat and prevent remote code execution (RCE) scenarios.",
  "technicalDetails": "The vulnerability resides in the ANGLE (Almost Native Graphics Layer Engine), the component responsible for translating OpenGL ES calls to platform-specific graphics APIs such as Direct3D, Vulkan, or Metal within the Chromium architecture.\nThe root cause of this vulnerability is an out-of-bounds write occurring during memory management or buffer operations within the ANGLE shader compilation or vertex processing logic.\nAn out-of-bounds write occurs when the application writes data past the allocated boundaries of a heap-based or stack-based buffer, potentially corrupting adjacent memory structures.\nIn the context of the Chromium sandbox, the ANGLE component processes complex graphical data provided by web content.\nWhen a specially crafted HTML page contains malicious WebGL or GPU-related commands, it forces the ANGLE engine to perform operations that lead to an unauthorized memory overwrite.\nThe exploitation flow initiates when the victim visits a compromised or attacker-controlled website. The malicious payload is delivered to the browser's rendering process, where the ANGLE component attempts to process the invalid or oversized graphical input.\nBy carefully grooming the heap, an attacker can overwrite critical function pointers, virtual method tables, or object metadata, effectively hijacking the control flow of the application process.\nBecause the ANGLE component operates in an environment where memory safety is critical, the corruption allows the attacker to bypass standard security boundaries enforced by the browser sandbox.\nOnce the initial memory corruption is achieved, the attacker can redirect execution to a payload of their choosing, which may involve return-oriented programming (ROP) or jump-oriented programming (JOP) chains to execute arbitrary code with the privileges of the renderer process.\nFrom there, the attacker may attempt to exploit secondary vulnerabilities or leverage system-level flaws to achieve full persistence or escape the browser environment entirely.\nThis flaw specifically affects Google Chrome versions prior to 152.0.7977.65 and does not require user authentication, making it a high-risk remote execution vector.\nThe reliance on browser-based rendering ensures that the attack is network-exposed, requiring only that the victim interacts with the malicious content."
}