Executive brief
A critical security vulnerability has been identified in Google Chrome's graphics engine (ANGLE). This flaw could allow a remote attacker to bypass the browser's security sandbox, which is the primary layer of defense that prevents malicious websites from accessing the rest of your computer. If exploited, an attacker could potentially gain full control over the affected system or access sensitive local data.
Technical details
This vulnerability is classified as an Improper Input Validation (CWE-20) issue within ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome. The flaw occurs when the engine fails to sufficiently validate untrusted input. An attacker who has already achieved code execution within the Chrome renderer process (typically via a separate vulnerability) can leverage this flaw to perform a sandbox escape. By enticing a user to visit a specially crafted HTML page, the attacker can break out of the restricted browser environment to execute arbitrary code on the host operating system. The issue is resolved in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome Prior to 150.0.7871.47
Timeline
- 2026-05-19: disclosed: Reported to Google internally
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47
- 2026-06-30: advisory