Description
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-30
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free bug in ANGLE, the graphics abstraction layer used by Google Chrome, can be triggered by a crafted HTML page loaded from the Internet. It may allow a remote attacker to escape the renderer sandbox. The flaw is enumerated as CWE‑416 and can compromise the confidentiality, integrity, and availability of affected systems.

Affected Systems

The vulnerability impacts Google Chrome on all platforms that use ANGLE, specifically versions earlier than 151.0.7922.72. Users running older Chrome releases are susceptible.

Risk and Exploitability

The CVSS score of 9.6 indicates critical severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack requires only a malicious web page and can lead to sandbox escape, making the threat realistic for consumers who browse the web.

Generated by OpenCVE AI on August 2, 2026 at 07:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 151.0.7922.72 or later
  • Confirm that Chrome’s sandboxing is enabled through settings or launch flags
  • Restrict or remove extensions that have privileged code execution capabilities until the patch is applied

Generated by OpenCVE AI on August 2, 2026 at 07:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Use after free in ANGLE
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 30 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T18:57:47.771Z

Reserved: 2026-07-27T23:34:30.031Z

Link: CVE-2026-17718

cve-icon Vulnrichment

Updated: 2026-07-30T18:57:38.934Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:34.353

Modified: 2026-08-03T17:46:39.633

Link: CVE-2026-17718

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-30T00:19:02Z

Links: CVE-2026-17718 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T07:15:03Z

Weaknesses