Executive brief
A vulnerability in Google Chrome's graphics engine (ANGLE) could allow an attacker to bypass the browser's security sandbox. If a user visits a malicious website and the attacker has already compromised the browser's rendering process, they could gain broader access to the underlying operating system. This could lead to unauthorized access to local files or the execution of malicious software on the victim's device.
Technical details
This vulnerability is classified as improper input validation (CWE-20) within ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome. The flaw allows a remote attacker to escape the Chrome sandbox if they have already achieved code execution within the renderer process (e.g., via a separate exploit). By enticing a user to visit a specially crafted HTML page, the attacker can leverage the insufficient validation to interact with the browser's underlying system beyond the restricted renderer environment. The issue was addressed in Chrome version 148.0.7778.216.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for Windows, Mac, and Linux.
- 2026-05-28: disclosed: CVE published to the NVD.