CVE-2026-78978

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

An out‑of‑bounds read in ANGLE on Windows exposes Google Chrome to a memory corruption flaw (CWE‑125). A maliciously crafted HTML page can trigger this vulnerability and allow an attacker to execute code outside the browser sandbox, potentially gaining full control of the user’s machine. Chromium security rated the issue as Medium severity but the remote code execution potential makes it a high‑impact flaw.

Affected Systems

Google Chrome running on Windows is affected when the build is older than version 152.0.7977.65. Users with any pre‑152.0.7977.65 Windows installation are vulnerable when they open a malicious webpage.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploits yet. Attackers would need to serve a specially crafted HTML page to a user who has a vulnerable Chrome build; upon viewing the page, the out‑of‑bounds read could be leveraged to escape the sandbox and run arbitrary code.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 152.0.7977.65 or newer on Windows.
  • Enable Chrome’s automatic update service to ensure future security patches are applied automatically.
  • Review the vendor’s release notes (e.g., https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html) for any temporary configuration changes, such as disabling ANGLE, until a patch is available.

Generated by OpenCVE AI on August 26, 2026 at 18:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Title Out-of-Bounds Read in ANGLE Leading to Sandbox Escape in Chrome on Windows
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Out-of-Bounds Read in ANGLE Leading to Sandbox Escape in Chrome on Windows
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-125
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:56 AM
Reserved
Aug 25, 2026, 6:06 AM

View source JSON

Updated
Aug 26, 2026, 2:14 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:17 PM
Modified
Aug 27, 2026, 4:17 AM

View source JSON

No data.

Updated
Aug 26, 2026, 6:30 PM

JSON