Description
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds read in ANGLE on Windows exposes Google Chrome to a memory corruption flaw (CWE‑125). A maliciously crafted HTML page can trigger this vulnerability and allow an attacker to execute code outside the browser sandbox, potentially gaining full control of the user’s machine. Chromium security rated the issue as Medium severity but the remote code execution potential makes it a high‑impact flaw.

Affected Systems

Google Chrome running on Windows is affected when the build is older than version 152.0.7977.65. Users with any pre‑152.0.7977.65 Windows installation are vulnerable when they open a malicious webpage.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits yet. Attackers would need to serve a specially crafted HTML page to a user who has a vulnerable Chrome build; upon viewing the page, the out‑of‑bounds read could be leveraged to escape the sandbox and run arbitrary code.

Generated by OpenCVE AI on August 26, 2026 at 18:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 152.0.7977.65 or newer on Windows.
  • Enable Chrome’s automatic update service to ensure future security patches are applied automatically.
  • Review the vendor’s release notes (e.g., https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html) for any temporary configuration changes, such as disabling ANGLE, until a patch is available.

Generated by OpenCVE AI on August 26, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Wed, 26 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Wed, 26 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in ANGLE Leading to Sandbox Escape in Chrome on Windows

Wed, 26 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Read in ANGLE Leading to Sandbox Escape in Chrome on Windows

Tue, 25 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-125
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:56:51.914Z

Reserved: 2026-08-25T06:06:34.786Z

Link: CVE-2026-78978

cve-icon Vulnrichment

Updated: 2026-08-26T14:14:47.535Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:17:54.207

Modified: 2026-08-27T04:17:08.657

Link: CVE-2026-78978

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T18:30:02Z

Weaknesses