Executive brief
Google Chrome is a widely used web browser. A security vulnerability was identified in its graphics engine (ANGLE) that could allow a malicious website to bypass the browser's security sandbox. If exploited, this could allow an attacker to gain unauthorized access to the underlying operating system or user data beyond the browser's restricted environment.
Technical details
An out-of-bounds write vulnerability (CWE-787) exists in the ANGLE component of Google Chrome. The flaw can be triggered by a remote attacker who has already compromised the renderer process, typically via a specially crafted HTML page. Successful exploitation allows the attacker to escape the Chrome sandbox and execute code with higher privileges on the host system. The issue was addressed in Google Chrome version 150.0.7871.182 for Windows and Mac, and 150.0.7871.181 for Linux.
Affected products
- Google Chrome prior to 150.0.7871.182
Timeline
- 2026-05-28: disclosed: Reported by Google internally
- 2026-07-21: patched: Fixed in stable channel update 150.0.7871.182
- 2026-07-21: advisory