Description

Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:09.500Z",
  "pubdate": "2026-08-25T21:18:09.500Z",
  "executiveSummary": "This vulnerability involves a buffer overflow condition within the ANGLE (Almost Native Graphics Layer Engine) component utilized by Google Chrome on Android platforms.\nThe flaw allows a remote attacker to achieve arbitrary code execution outside the browser's security sandbox environment.\nAffected products include Google Chrome on Android versions prior to 152.0.7977.65.\nThe vulnerability is classified with a High security severity, indicating that successful exploitation poses a significant threat to device integrity and user data privacy.\nExploitation requires minimal user interaction, typically involving the victim navigating to a maliciously crafted HTML page designed to trigger the memory corruption.\nBy bypassing sandbox restrictions, the attacker can execute code with elevated permissions relative to the browser process, potentially leading to unauthorized data access, persistence, or full device compromise.",
  "technicalDetails": "The vulnerability stems from an improper memory management implementation within the ANGLE component, which serves as the graphics abstraction layer for Chromium-based browsers.\nA buffer overflow occurs when the application writes data beyond the allocated boundaries of a buffer in memory, leading to the corruption of adjacent data structures, control flow metadata, or function pointers.\nIn this specific context, the overflow is triggered through the processing of a crafted HTML page, likely involving malformed WebGL or graphics-related inputs that ANGLE fails to sanitize or bounds-check appropriately.\nThe attack flow begins when a remote attacker hosts a malicious website containing the exploit payload. When the target user navigates to this page via Google Chrome on an affected Android device, the browser invokes the vulnerable ANGLE component to render the graphics content.\nAs the engine parses the malicious input, the heap or stack-based buffer overflow is triggered, allowing the attacker to overwrite critical memory addresses. By carefully crafting the malicious input, the attacker can redirect the execution flow to a custom payload, often facilitated by techniques such as Return-Oriented Programming (ROP) to bypass Data Execution Prevention (DEP) and other modern exploit mitigations.\nCrucially, this vulnerability allows for sandbox escape. The browser's sandbox is designed to isolate the rendering process; however, because the flaw exists within a component that interfaces directly with lower-level graphics drivers or system libraries, a successful exploit can compromise the integrity of the process container.\nOnce the sandbox is breached, the arbitrary code executes with the privileges associated with the Chrome process, enabling the attacker to perform unauthorized actions beyond the limitations of the web rendering engine.\nThe vulnerability affects versions of Google Chrome for Android prior to 152.0.7977.65. Authentication is not required for successful exploitation, and the attack is reachable via standard web navigation, making it highly accessible to remote threat actors."
}