Executive brief
A vulnerability in Google Chrome's graphics engine could allow a malicious website to bypass the browser's security sandbox. The sandbox is a critical safety layer designed to prevent malicious code from escaping the browser to access the rest of the computer. If exploited, an attacker could potentially gain unauthorized access to the underlying operating system and user data.
Technical details
An improper input validation vulnerability (CWE-20) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw allows a remote attacker to bypass the Chromium sandbox by enticing a user to visit a specially crafted HTML page. By providing malicious input that the ANGLE engine fails to properly validate, an attacker can achieve code execution outside of the restricted browser process. This vulnerability is addressed in Chrome version 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and Mac.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published by NVD.