CVE-2026-17801

chromium-browser: chromium-browser: Out of bounds memory access in ANGLE

Published Jul 30, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Description

Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

The vulnerability is an out‑of‑bounds read and write in ANGLE, a graphics abstraction layer used by Chrome. The flaw allows a remote attacker who can deliver a crafted HTML page to a victim to potentially escape the browser sandbox and execute code with elevated privileges. The weakness is identified as CWE‑125, which represents memory safety errors such as buffer overreads and overwrites.

Affected Systems

Google Chrome browsers prior to version 151.0.7922.72 are affected. No additional vendor or product variants are noted.

Risk and Exploitability

The CVSS score of 9.6 indicates a high‑severity risk, but the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a malicious web page that a user visits, leveraging the browser’s rendering engine to trigger the out‑of‑bounds memory access and achieve sandbox escape.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`151.0.7922.72`	affected	< 151.0.7922.72

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`151.0.7922.72`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Chrome to version 151.0.7922.72 or later, which contains the ANGLE fix
If an upgrade is not immediately feasible, launch Chrome with the --disable-gpu flag to avoid using ANGLE hardware acceleration as a mitigated measure
Maintain Chrome’s default sandbox and site isolation settings to restrict any out‑of‑bounds execution from occurring

Generated by OpenCVE AI on August 2, 2026 at 06:47 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4710-1	chromium security update
Debian DSA	DSA-6408-1	chromium security update
Debian DSA	DSA-6534-1	webkit2gtk security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.428% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html
https://issues.chromium.org/issues/514482938
https://nvd.nist.gov/vuln/detail/CVE-2026-17801
https://www.cve.org/CVERecord?id=CVE-2026-17801

History

Jul 31, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`

Jul 31, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		chromium-browser: chromium-browser: Out of bounds memory access in ANGLE
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-17801 https://www.cve.org/CVERecord?id=CVE-2026-17801
Metrics	threat_severity `None`	cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L'}` threat_severity `Moderate`

Jul 30, 2026 5:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jul 30, 2026 1:00 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
References		https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html https://issues.chromium.org/issues/514482938