Executive brief
A security vulnerability exists in Google Chrome's graphics engine (ANGLE). If a user visits a specially crafted malicious website, an attacker who has already compromised the browser's rendering process could bypass security boundaries (the sandbox). This could allow the attacker to gain broader access to the underlying operating system and user data.
Technical details
A use-after-free (UAF) vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw is triggered when the browser incorrectly manages memory during the processing of graphics commands. An attacker who has already achieved code execution within the sandboxed renderer process can exploit this memory corruption to escape the sandbox and execute arbitrary code on the host system. This requires the victim to navigate to a malicious HTML page. The issue is resolved in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: CVE published