Description

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:18.283Z",
  "pubdate": "2026-08-25T21:18:18.283Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) write flaw residing within the ANGLE graphics abstraction layer utilized by Google Chrome on Windows.\nThe vulnerability carries a High security severity rating, indicating a significant risk to user systems.\nSuccessful exploitation allows a remote, unauthenticated attacker to execute arbitrary code within the constraints of the browser's security sandbox.\nThe attack vector involves a crafted HTML page, necessitating user interaction such as navigating to a malicious website.\nBy triggering a memory corruption condition through the ANGLE component, an attacker can overwrite adjacent memory locations, potentially diverting the control flow of the browser process.\nWhile the impact is initially contained within the sandbox, code execution at this level is often a critical step in multi-stage exploit chains that attempt to escape the sandbox and achieve full system compromise.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65 on the Windows platform.",
  "technicalDetails": "The vulnerability stems from an out-of-bounds write error within the ANGLE (Almost Native Graphics Layer Engine) component. ANGLE serves as the translation layer between high-level graphics APIs (such as OpenGL ES) and underlying platform-specific APIs like Direct3D on Windows. The core issue involves the improper validation of input or memory offsets during graphics command processing.\nIn a typical scenario, when Chrome processes WebGL or other GPU-accelerated content, it translates these calls through ANGLE. An out-of-bounds write occurs when the software fails to enforce strict boundary checks on data buffers or pointer arithmetic during command serialization or shader translation. If a crafted HTML page provides malicious input—such as an oversized buffer request or a manipulated index—the underlying ANGLE driver may write data beyond the allocated memory boundary.\nThe exploitation flow begins when a victim visits a web page containing a malicious payload designed to trigger the vulnerable graphics operation. As the renderer process handles the rendering tasks, the malformed graphics commands are passed to the ANGLE engine. The engine performs an operation that accesses memory outside the intended buffer. Because this write operation occurs in the context of the renderer, the attacker can influence the heap layout or corrupt adjacent metadata, such as object pointers, vtable entries, or function pointers.\nBy overwriting critical data structures, the attacker can achieve a primitive that allows for code execution control. This typically involves placing shellcode or a ROP chain in memory and redirecting the execution pointer to the malicious payload. Because this happens within the browser's renderer process, the attacker is initially restricted by the sandbox environment, which limits access to the file system, network resources, and operating system APIs.\nDespite the sandbox restrictions, successful arbitrary code execution within the renderer is a high-impact event. It allows the attacker to steal sensitive information such as browser cookies, authentication tokens, and session history. Furthermore, it provides an ideal starting point for launching secondary exploits against the browser's sandbox implementation or the underlying operating system kernel, potentially leading to a full system compromise. The vulnerability is triggered remotely without user authentication, requiring only that the victim navigates to the malicious resource."
}