Executive brief
Google Chrome is a widely used web browser. A security vulnerability in its graphics engine (ANGLE) could allow a remote attacker to bypass the browser's security sandbox. If exploited, this could allow an attacker who has already gained a foothold in the browser to gain broader access to the underlying computer system, potentially leading to data theft or full system compromise.
Technical details
A use-after-free (UAF) vulnerability exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the browser attempts to access memory that has already been freed, which can be induced via a specially crafted HTML page. An attacker who has already achieved code execution within the renderer process (e.g., via a separate vulnerability) can leverage this UAF to escape the Chrome sandbox and execute arbitrary code on the host operating system. This vulnerability is addressed in Chrome version 147.0.7727.138 and later.
Affected products
- Google Chrome < 147.0.7727.138
Timeline
- 2026-03-25: disclosed: Reported to Google by internal researchers
- 2026-04-28: advisory: NVD and Google Chrome release advisory published
- 2026-04-28: patched: Fixed in version 147.0.7727.138