Description

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:12.597Z",
  "pubdate": "2026-08-25T21:18:12.597Z",
  "executiveSummary": "A high-severity out-of-bounds write vulnerability exists within the ANGLE (Almost Native Graphics Layer Engine) component of the Google Chrome web browser.\nThe vulnerability occurs prior to version 152.0.7977.65 and poses a significant risk to user systems by facilitating potential arbitrary code execution.\nA remote attacker can leverage this flaw by inducing a victim to visit a maliciously crafted HTML page, which triggers the memory corruption.\nSuccessful exploitation allows an attacker to break out of the browser's sandbox environment, granting the potential for system-wide compromise or unauthorized access to sensitive data.\nThis vulnerability is classified as high risk due to its potential to bypass key browser security boundaries without requiring local system access or user interaction beyond navigating to a specific URL.",
  "technicalDetails": "The vulnerability is identified as an out-of-bounds (OOB) write, localized within the ANGLE library, which serves as the abstraction layer for mapping OpenGL ES calls to platform-specific graphics APIs like Direct3D, Vulkan, or Metal within the Chromium architecture.\nRoot cause analysis points to improper bounds checking when processing inputs within the graphics pipeline. When the browser parses or renders complex graphical operations through the ANGLE component, a failure to validate buffer sizes or index offsets allows data to be written outside of the allocated memory heap or stack segment.\nThe attack flow begins when a remote attacker hosts a specially crafted HTML page containing malicious WebGL or graphics-related JavaScript calls. When the target browser processes these calls, the ANGLE component performs an operations sequence that triggers the OOB write condition.\nBy manipulating the content passed to the graphics driver abstraction, an attacker can control the data being written to memory adjacent to the intended buffer. This memory corruption is often leveraged to overwrite function pointers, object vtables, or return addresses, effectively redirecting the control flow of the browser process.\nBecause ANGLE operates as part of the browser's GPU process or renderer process, the exploitation of this memory corruption serves as a primitive for escaping the browser sandbox. The sandbox is intended to isolate browser operations from the host operating system; however, an OOB write that leads to arbitrary code execution provides the attacker with the privilege level of the exploited process.\nIf the exploit reaches the underlying OS layer, the attacker may bypass the sandbox entirely, executing arbitrary shellcode on the host machine. The lack of proper memory safety enforcement within the vulnerable ANGLE code paths allows the malicious payload to persist or escalate privileges, leading to full system compromise depending on the prevailing system configuration.\nVersions of Google Chrome prior to 152.0.7977.65 are susceptible to this flaw. Authentication is not required, as the vulnerability is reachable via standard web browsing activities, making this an unauthenticated remote exploitation vector."
}