Executive brief
A vulnerability in Google Chrome's graphics translation layer (ANGLE) could allow a malicious website to corrupt the browser's memory. By tricking a user into visiting a specially crafted webpage, an attacker could potentially cause the browser to crash or execute unauthorized code. This poses a risk to the confidentiality of user data and the overall stability of the application.
Technical details
A heap buffer overflow vulnerability (CWE-122) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to heap corruption. A remote, unauthenticated attacker can exploit this by hosting a malicious website and enticing a user to visit it. Successful exploitation could lead to arbitrary code execution within the context of the browser's renderer process or a denial-of-service condition. The issue is addressed in Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: CVE published to NVD dataset