Executive brief
A security vulnerability has been identified in Google Chrome's ANGLE graphics engine. By tricking a user into visiting a specially crafted website, an attacker could execute malicious code on the user's computer. While this code is restricted by Chrome's security sandbox, it still represents a significant risk to the integrity of the browser and user data.
Technical details
A use-after-free (UAF) vulnerability exists in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome. The flaw is triggered when the browser attempts to access memory that has already been freed, typically during the processing of complex graphics instructions. A remote attacker can exploit this by hosting a malicious HTML page that, when rendered, triggers the memory corruption. This allows for arbitrary code execution within the context of the Chrome sandbox. The issue is resolved in Google Chrome version 148.0.7778.216 and later.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for desktop
- 2026-05-28: disclosed: NVD publication date