Description

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:10.160Z",
  "pubdate": "2026-08-25T21:18:10.160Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the ANGLE graphics engine integration of Google Chrome prior to version 152.0.7977.65. This memory corruption flaw allows a remote, unauthenticated attacker to execute arbitrary code on a target system.\nThe vulnerability manifests during the processing of specialized HTML content, which triggers an invalid memory access pattern within the ANGLE component. By leveraging this UAF condition, an attacker can bypass browser sandbox protections, leading to arbitrary code execution (ACE).\nGiven the nature of web-based delivery, the exploitation requirements are minimal, typically involving the victim visiting a malicious website. Successful exploitation compromises the confidentiality, integrity, and availability of the host system, granting the attacker significant control over the browser process and potentially the underlying operating system.\nThis vulnerability is classified with High severity due to the potential for remote code execution (RCE) and the high prevalence of Chrome-based browsing environments. Rapid patching to the specified version or newer is required to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the ANGLE (Almost Native Graphics Layer Engine) component of the Chromium browser framework. ANGLE acts as a translation layer, mapping OpenGL ES calls to platform-specific graphics APIs such as Direct3D, Metal, or Vulkan. A Use-After-Free condition occurs when the engine incorrectly manages the lifecycle of graphics-related objects in memory.\nIn the context of the vulnerability, memory associated with an internal ANGLE resource is prematurely deallocated (freed) while a reference to that object still persists within the component's state machine. If the application continues to reference this dangling pointer, it effectively performs an operation on memory that may have been repurposed for other tasks, leading to memory corruption.\nThe attack flow begins when a remote attacker delivers a specifically crafted HTML page to the victim. This page includes malicious JavaScript or WebGL code designed to induce a specific sequence of graphics pipeline state transitions. By manipulating the browser's interaction with the ANGLE engine, the attacker triggers the premature free operation while maintaining a stale reference to the object.\nOnce the dangling pointer is established, the attacker performs heap grooming or memory spraying techniques to replace the freed memory block with controlled data. Subsequent execution paths in the ANGLE engine then utilize this corrupted memory. If the data is interpreted as an object, a vtable, or a function pointer, the attacker can redirect the program counter to arbitrary shellcode or perform Return-Oriented Programming (ROP) to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\nBecause ANGLE operations occur within the browser context, this vulnerability facilitates a sandbox escape. The exploit payload, executed via the corrupted memory, allows the attacker to break out of the restricted Chromium rendering process, potentially achieving code execution with the privileges of the logged-in user. This bypasses the isolation mechanisms intended to protect the operating system from malicious web content.\nThe vulnerability affects Google Chrome versions prior to 152.0.7977.65. Exploitation does not require prior authentication, and the attack surface is exposed to any user navigating to a hostile URL. Post-exploitation, the attacker gains the ability to execute persistent commands, exfiltrate local data, or pivot to internal network resources."
}