Executive brief
Google Chrome's ANGLE graphics library contains an out of bounds read vulnerability that allows a remote attacker to access memory outside the browser's sandbox. An attacker can exploit this by serving a specially crafted HTML page to a user, potentially reading sensitive data stored in memory and escaping the security sandbox designed to contain browser processes.
Technical details
An out of bounds read vulnerability exists in ANGLE (Almost Native Graphics Layer Engine), a graphics abstraction layer used in Chromium and Chrome. The vulnerability allows reading memory outside allocated buffers, which can bypass the sandbox isolation that normally restricts browser processes. Attack vector is network-based: an attacker crafts a malicious HTML page and serves it to a victim. No user interaction beyond visiting the page is required. Successful exploitation enables memory disclosure and potential sandbox escape. The vulnerability was patched in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36
- 2026-09-09: disclosed