Description

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-25T21:18:22.090Z",
  "pubdate": "2026-08-25T21:18:22.090Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the ANGLE graphics abstraction layer of Google Chrome prior to version 152.0.7977.65. This memory corruption flaw permits a remote attacker to achieve arbitrary code execution beyond the security boundaries of the browser sandbox.\nThe vulnerability originates from improper memory management during the processing of crafted HTML content. By leveraging a malicious web page, an attacker can manipulate heap memory states to trigger a UAF condition, leading to unauthorized read/write access or execution of arbitrary payloads. Given the nature of ANGLE, the vulnerability impacts the interaction between the browser's rendering engine and the underlying GPU hardware/drivers.\nThe severity is classified as High, reflecting the potential for full system compromise if chained with sandbox escape primitives or utilized to bypass browser security controls. Successful exploitation requires the user to interact with the attacker-controlled content, typically via navigation to a compromised or malicious URL. The primary risk involves complete browser exploitation, data exfiltration, or persistence mechanisms delivered via client-side code execution.",
  "technicalDetails": "The vulnerability is localized within the ANGLE (Almost Native Graphics Layer Engine) component of the Chromium project, which acts as a conformant implementation of the OpenGL ES API. The flaw is identified as a Use-After-Free condition, a memory corruption error where an application continues to utilize a pointer after the memory it references has been deallocated.\nThe attack flow begins with the delivery of a specially crafted HTML page containing complex WebGL or graphics-related assets. When the browser rendering engine parses these elements, the ANGLE component processes the shader or buffer objects. Due to a race condition or an improper reference counting implementation, a memory object associated with a graphics resource is prematurely freed while still referenced by an active process or thread.\nOnce the memory has been returned to the allocator, the attacker uses heap spraying techniques—often by allocating numerous JavaScript objects or TypedArrays of a similar size—to fill the freed memory slot with controlled data. When the vulnerable code subsequently attempts to access the stale pointer, it operates on data injected by the attacker rather than the expected object.\nThis hijacking of the execution flow allows the attacker to redirect code pointers, such as virtual method tables (vtable) or return addresses. By controlling the contents of the freed memory block, an attacker can pivot execution to arbitrary shellcode or perform Return-Oriented Programming (ROP) to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).\nBecause ANGLE operates as a critical bridge between high-level browser commands and low-level graphics processing, successful exploitation often grants the attacker execution privileges at the level of the GPU process. While this process is typically sandboxed, the capability to execute arbitrary code within the context of the browser environment facilitates subsequent sandbox escape attempts, ultimately allowing for code execution on the underlying host operating system.\nThe vulnerability affects all Google Chrome instances prior to version 152.0.7977.65. No authentication is required for exploitation; the threat is purely remote and relies on the browser's ability to interpret malicious graphics input. The post-exploitation impact includes the potential for local file access, installation of unauthorized software, or complete user system compromise, depending on the efficacy of the browser sandbox at the time of the incident."
}