Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its graphics engine (ANGLE) could allow a malicious website to break out of the browser's security sandbox. If exploited, an attacker who has already gained a foothold in the browser's rendering process could potentially gain broader access to the underlying operating system or user data.
Technical details
An improper input validation vulnerability (CWE-20) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw allows a remote attacker to bypass sandbox restrictions if they have already compromised the renderer process. By convincing a user to visit a specially crafted HTML page, the attacker can leverage the insufficient validation to escape the process isolation. This vulnerability was addressed in Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-05-17: disclosed: Reported to Chrome by internal researchers
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47/.46
- 2026-06-30: advisory