Description
Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw in the ANGLE graphics layer of Google Chrome versions prior to 149.0.7827.53 can be exploited by a remote attacker who has already compromised the renderer process to escape the sandbox and obtain higher privilege. The weakness is a classic CWE‑416 condition and a related CWE‑825 memory management flaw, and has been rated Medium severity by the Chromium security team.

Affected Systems

Chromium‑based browsers running Google Chrome, with affected releases being any version before Chrome 149.0.7827.53. Based on the description, the vulnerability likely applies to desktop environments. The security patch was rolled out in the 149.0.7827.53 update released by the stable channel.

Risk and Exploitability

The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no current evidence of widespread exploitation. The CVSS score of 9.6 highlights a high severity level for this flaw. The attack path requires the attacker to first compromise the renderer process. Based on the description, it is inferred that the probability of successful exploitation is moderate. Once the renderer is compromised, the sandbox escape can lead to full system control on the affected device.

Generated by OpenCVE AI on June 7, 2026 at 14:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later through the standard update mechanism.
  • Ensure all other software that can interact with Chrome is fully patched to prevent initial renderer compromise.
  • Maintain vigilant monitoring of Chrome logs for unexpected renderer failures or anomalous activity.

Generated by OpenCVE AI on June 7, 2026 at 14:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in ANGLE
Weaknesses CWE-825
References
Metrics threat_severity

None

threat_severity

Moderate


Fri, 05 Jun 2026 21:15:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in ANGLE Enables Sandbox Escape in Google Chrome

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Fri, 05 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 05 Jun 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 05:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in ANGLE Enables Sandbox Escape in Google Chrome

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-416
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T18:24:29.543Z

Reserved: 2026-06-04T17:06:41.817Z

Link: CVE-2026-11065

cve-icon Vulnrichment

Updated: 2026-06-05T18:24:24.313Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:11.023

Modified: 2026-06-05T20:27:56.633

Link: CVE-2026-11065

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11065 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T14:30:16Z

Weaknesses