Executive brief
A security vulnerability has been identified in Google Chrome's ANGLE component, which handles graphics rendering. By tricking a user into visiting a specially crafted website, a remote attacker could cause the browser to crash or potentially execute unauthorized code on the user's computer. This could lead to the theft of sensitive information or a complete compromise of the user's browsing session.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to heap corruption. A remote, unauthenticated attacker can exploit this by inducing a user to visit a malicious website. Successful exploitation could allow for arbitrary code execution within the context of the browser's renderer process. The vulnerability is addressed in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-03-02: other: Vulnerability reported by researcher sweetchip
- 2026-06-02: patched: Fix released in Chrome version 149.0.7827.53
- 2026-06-04: disclosed: Public advisory published