Executive brief
Google Chrome contains an out of bounds memory read vulnerability in its ANGLE graphics library that affects versions prior to 153.0.8010.36. An attacker who has already compromised the browser's renderer process can exploit this to execute arbitrary code outside Chrome's security sandbox, potentially gaining full system access.
Technical details
This vulnerability is an out of bounds read in ANGLE (a Direct3D abstraction library used by Chrome for graphics rendering). The issue requires an attacker to have already compromised the renderer process, and can be triggered via a crafted HTML page. Successful exploitation allows code execution outside the sandbox protection that normally isolates web content from the host system. The vulnerability was patched in Chrome 153.0.8010.36 released on September 8, 2026. Chromium assigned this a High severity rating.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched