Description

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:09.057Z",
  "pubdate": "2026-08-25T21:18:09.057Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified within the ANGLE graphics engine component of Google Chrome on Windows.\nThe vulnerability allows a remote attacker to achieve arbitrary code execution outside the browser sandbox context.\nAffected versions include Google Chrome on Windows prior to 152.0.7977.65.\nThe security severity is classified as High by the Chromium project due to the potential for full system compromise or sandbox escape.\nExploitation requires a user to navigate to a specifically crafted HTML page that triggers the flaw via the rendering pipeline.\nThe primary risk involves memory corruption, which an attacker can leverage to bypass browser security boundaries, leading to unauthorized code execution on the underlying host operating system.\nNo authentication is required for exploitation, making it a significant threat if a user is lured to malicious content.",
  "technicalDetails": "The vulnerability originates within the ANGLE (Almost Native Graphics Layer Engine) component, which is responsible for abstracting various graphics APIs into a unified interface for Chromium. Specifically, the flaw is an out-of-bounds write condition that occurs during the translation or processing of graphics commands.\nRoot Cause Analysis: The issue stems from insufficient bounds checking when handling memory buffers during the execution of rendering commands. When the ANGLE engine processes malicious graphics inputs or shaders provided through a crafted HTML page, it fails to validate the size or offset of data being written into memory buffers. This results in the engine writing data beyond the allocated memory segment.\nExploitation Flow: 1. An attacker hosts a malicious HTML page containing specially crafted WebGL or graphics-related JavaScript. 2. Upon visiting the page, the browser's rendering engine passes the malicious instructions to the ANGLE component. 3. The ANGLE component, failing to perform rigorous bounds validation, triggers the memory corruption while processing the graphics command. 4. Through careful manipulation of the heap layout or adjacent memory structures, the attacker overwrites critical function pointers or sensitive data objects. 5. By redirecting the instruction pointer to attacker-controlled shellcode or a ROP (Return-Oriented Programming) chain, the attacker gains execution privileges.\nImpact: Successful exploitation enables the attacker to escape the Chromium sandbox, which acts as the primary layer of defense between the browser and the Windows host. This allows the attacker to execute arbitrary code with the privileges of the currently logged-in user, potentially leading to total system compromise, data exfiltration, or the installation of persistent malware.\nComplexity: While memory corruption exploitation typically requires bypasses for modern mitigations like ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention), the out-of-bounds write primitive provides a powerful mechanism for memory manipulation that can be used to leak pointers and facilitate these bypasses. The lack of authentication requirements and the ability to trigger the vulnerability via remote web content make this a high-impact flaw."
}