Executive brief
Google Chrome's ANGLE graphics component failed to properly validate array indices, allowing attackers to execute arbitrary code outside the browser sandbox by tricking users into visiting a malicious webpage. This could enable complete compromise of a user's system, including data theft, malware installation, and unauthorized access to sensitive files and accounts.
Technical details
This vulnerability exists in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer in Chrome, due to improper validation of array indices. An attacker can craft a malicious HTML page that triggers the out-of-bounds access via WebGL or similar graphics APIs. The vulnerability allows remote code execution outside the sandbox boundary, meaning an attacker escapes Chrome's security isolation. No authentication or special user privileges are required; the attack is triggered by simply visiting the malicious webpage. The vulnerability affects Chrome versions prior to 153.0.8010.36, which includes the fix.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released