Description

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:12.483Z",
  "pubdate": "2026-08-25T21:18:12.483Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability has been identified in the ANGLE graphics engine component of Google Chrome.\nThe vulnerability resides in the way ANGLE processes memory during graphics operations, allowing for memory corruption beyond intended buffer boundaries.\nSuccessful exploitation by a remote attacker could lead to arbitrary code execution, bypassing the Chromium sandbox environment.\nThis issue impacts Google Chrome versions prior to 152.0.7977.65.\nThe risk implication is significant as the vulnerability can be triggered via a crafted HTML page, requiring no user interaction beyond navigating to a malicious site.\nThe attack is characterized as remote, with no authentication or elevated privileges required from the attacker to initiate the exploitation sequence.",
  "technicalDetails": "The vulnerability is an out-of-bounds write occurring within the ANGLE (Almost Native Graphics Layer Engine) library, which is used by the Chromium project to translate OpenGL ES API calls into platform-specific graphics APIs such as Direct3D, Vulkan, or Metal.\nThe root cause involves improper bounds checking when managing internal data buffers or structures within the ANGLE component during the processing of complex graphics commands.\nAn attacker can exploit this flaw by crafting a malicious HTML page containing specifically engineered WebGL or WebGPU instructions. When the browser renders the page, these instructions are passed to the ANGLE engine for translation.\nBecause of the insufficient validation, the attacker can force the engine to write data to unauthorized memory locations. By meticulously controlling the contents and the destination of the write operation, an attacker can overwrite critical control structures, such as function pointers or object vtables.\nThe attack flow proceeds as follows: First, the attacker lures the victim to a website containing a malicious payload. Second, the browser triggers the GPU process to handle the graphics-intensive content. Third, the crafted command triggers the out-of-bounds write in ANGLE, corrupting memory within the GPU process. Fourth, the attacker leverages this corruption to hijack the instruction pointer, leading to arbitrary code execution.\nWhile the GPU process in Chrome is sandboxed to isolate it from the rest of the operating system, this specific vulnerability allows the attacker to break out of that sandbox, granting them broader control over the affected system.\nThis vulnerability is particularly dangerous because it bypasses standard browser-level security mitigations, as the exploit targets the underlying graphics abstraction layer rather than the JavaScript engine directly.\nThe vulnerability affects all Google Chrome versions prior to 152.0.7977.65. Successful exploitation results in the compromise of the system under the context of the user running the browser process, potentially allowing for malware installation, data exfiltration, or further lateral movement within the network."
}