CVE-2026-17832

The vulnerability is a use-after-free flaw in ANGLE, the graphics abstraction layer used by Chromium. An attacker who can compromise the renderer process can trigger freed memory to be accessed via a crafted HTML page, potentially causing a sandbox escape. Based on the description, it is inferred that this escape could allow the attacker to execute code with privileges higher than those of the renderer, potentially leading to broader system compromise. The flaw is identified as CWE-416 and CWE-825.

Google Chrome up to and including version 151.0.7922.71 (any build before 151.0.7922.72). The affected component is the ANGLE renderer within the Chromium browser. Any deployment of Chrome that uses this renderer path is susceptible.

The CVSS score of 9.6 classifies this issue as critical. The EPSS score of less than 1% indicates a very low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires a malicious or compromised web page that is rendered inside an untrusted process; once the renderer is compromised, the attacker can exploit the use-after-free to escape the sandbox. Based on the description, it is inferred that the sandbox escape could enable privileged code execution beyond the renderer, potentially affecting other system components. Given the exploitation path involves precise memory manipulation, achieving this remotely without initial renderer compromise would be challenging.