Executive brief
A vulnerability exists in Google Chrome's ANGLE component, which handles graphics rendering. An attacker who has already compromised a browser tab's process could use this flaw to break out of the browser's security sandbox. This could allow the attacker to gain broader access to the underlying operating system and user data.
Technical details
A use-after-free vulnerability (CWE-416) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is reachable via a crafted HTML page. A remote attacker who has already achieved code execution within a compromised renderer process can exploit this memory corruption to perform a sandbox escape. This would allow the attacker to execute arbitrary code with the privileges of the browser process on the host system. The issue is resolved in Chrome version 151.0.7922.72 and later.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: disclosed
- 2026-07-29: patched: Fixed in version 151.0.7922.72
- 2026-07-30: advisory