Description
Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Published: 2026-04-28
Score: 9.0 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Sandbox Escape
Action: Immediate Patch
AI Analysis

Impact

Use after free in ANGLE within Google Chrome before version 147.0.7727.138 allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox by loading a crafted HTML page. This vulnerability can lead to arbitrary code execution that breaks out of the browser environment, granting the attacker access to system resources and data.

Affected Systems

Google Chrome versions earlier than 147.0.7727.138 are affected. Only Chrome users on these older stable channel releases are impacted.

Risk and Exploitability

The Chromium severity is marked High. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain control of the renderer process, which limits the attack surface. Consequently, while the potential impact is severe, the likelihood of a successful attack is moderate to low without a prior renderer compromise.

Generated by OpenCVE AI on April 29, 2026 at 01:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Chrome update that includes the ANGLE patch (version 147.0.7727.138 or later).
  • Restrict access to untrusted web content by running Chrome inside a virtual machine or container that limits renderer privileges.
  • Keep the host operating system and security updates current to minimize the risk of a prior renderer compromise that could be leveraged against this flaw.

Generated by OpenCVE AI on April 29, 2026 at 01:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Use after free in ANGLE allows sandbox escape in Chrome renderer chromium-browser: Use after free in ANGLE
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Wed, 29 Apr 2026 01:30:00 +0000

Type Values Removed Values Added
Title Use after free in ANGLE allows sandbox escape in Chrome renderer

Wed, 29 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 28 Apr 2026 23:00:00 +0000

Type Values Removed Values Added
Description Use after free in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-04-28T22:35:56.218Z

Reserved: 2026-04-28T20:02:47.674Z

Link: CVE-2026-7359

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-28T23:16:23.470

Modified: 2026-04-28T23:16:23.470

Link: CVE-2026-7359

cve-icon Redhat

Severity : Important

Publid Date: 2026-04-28T00:00:00Z

Links: CVE-2026-7359 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T01:15:44Z

Weaknesses