The vulnerability is a type‑confusion bug in ANGLE, a graphics‑to‑WebGL translation layer used by Chrome. A remote attacker can feed a specially crafted HTML page that causes the browser sandbox to be bypassed, enabling arbitrary code execution outside the browser context. The impact is thus the loss of sandbox isolation, potentially leading to system compromise. The weakness is classified as CWE‑843.

Google Chrome is the affected product. All Chrome builds prior to version 151.0.7922.72 contain the flaw. The issue was tracked in Chromium issue 517575864, and the Chrome team released the fix in the July 2026 stable channel update.

The CVSS score of 9.6 signals a high‑severity flaw, and the EPSS score of less than 1% indicates that real‑world exploitation is currently rare. However, because the attack vector is remote via an HTML page, any web user who visits a malicious site could be at risk unless Chrome is patched. The flaw is not yet listed in CISA’s KEV. Because the sandbox can be bypassed, the potential for remote code execution on the host makes this a critical issue if unpatched, but the low exploitation probability mitigates immediate pressure for many environments.