Executive brief
A security vulnerability in Google Chrome's graphics engine could allow a malicious website to break out of the browser's security sandbox. This typically occurs after an attacker has already gained partial control over a browser tab, potentially leading to full control over the underlying computer system. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within ANGLE, the graphics abstraction layer used by Google Chrome. The flaw allows a remote attacker who has already achieved code execution within the sandboxed renderer process to bypass sandbox restrictions. By enticing a user to visit a specially crafted HTML page, the attacker can exploit this insufficient validation to escape the sandbox and execute arbitrary code on the host operating system. The issue is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: CVE published to NVD