Description
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-25
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate patch
AI Analysis

Impact

An out-of-bounds write in ANGLE, the graphics component of Chrome, allows a remote attacker to craft a malicious HTML page that, when rendered on Windows, can escape the browser sandbox and execute arbitrary code. This high-severity flaw is a classic memory-corruption vulnerability that could compromise system confidentiality, integrity, or availability.

Affected Systems

The flaw affects Google Chrome running on Windows. No other operating systems or Chrome products are explicitly listed as impacted.

Risk and Exploitability

The CVSS score of 9.6 signals critical risk. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is a remote attacker delivering a crafted web page to a user. If exploited, the attacker could gain full system control by breaking out of the browser sandbox.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on Windows to the latest stable release, which contains the ANGLE patch that fixes the out-of-bounds write.
  • Enable Chrome automatic updates or implement an enterprise patch-management schedule to keep Chrome current.
  • Until updating, restrict users from accessing untrusted web content and enforce network filtering or sandbox extensions to mitigate risk.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Wed, 26 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Chrome ANGLE Out‑of‑Bounds Write Enables Remote Code Execution on Windows

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Wed, 26 Aug 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Chrome ANGLE Out‑of‑Bounds Write Enables Remote Code Execution on Windows

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-787
References

Subscriptions

Google Chrome
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:57:40.708Z

Reserved: 2026-08-25T06:10:15.433Z

Link: CVE-2026-79138

cve-icon Vulnrichment

Updated: 2026-08-26T15:58:42.647Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:09.057

Modified: 2026-08-27T12:38:48.580

Link: CVE-2026-79138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:30:11Z

Weaknesses