Executive brief
Google Chrome's graphics rendering engine (ANGLE) contains a memory boundary flaw that allows attackers to write data beyond allocated memory limits. An attacker can exploit this vulnerability by crafting a malicious HTML page that, when viewed in a vulnerable Chrome browser, executes arbitrary code outside Chrome's security sandbox, potentially compromising system security and user data.
Technical details
An out-of-bounds write vulnerability exists in the ANGLE graphics library (which handles WebGL and Direct3D rendering) within Google Chrome on Windows versions prior to 152.0.7977.65. The vulnerability stems from improper bounds checking in memory operations, allowing an attacker to write data beyond allocated buffer boundaries. The attack is triggered via a crafted HTML page delivered over the network with no authentication or user interaction required beyond viewing the page. Successful exploitation enables arbitrary code execution outside Chrome's sandbox, bypassing the browser's security isolation and granting full system privileges. The vulnerability is patched in Chrome 152.0.7977.65 and later.
Affected products
- Google Chrome prior to 152.0.7977.65 on Windows
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65