Description
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-25
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds memory write in the ANGLE component of Google Chrome versions older than 152.0.7977.65. A specially crafted HTML page can trigger this write, allowing a remote attacker to write beyond allocated buffers and potentially execute arbitrary code outside the browser sandbox. The flaw stems from a lack of proper bounds checking in the ANGLE graphics layer, and it is classified as CWE‑787.

Affected Systems

Google Chrome is the affected product; any installation running a version earlier than 152.0.7977.65 is vulnerable. This includes the stable channel releases updated before the August 2026 patch published by Google. Users of older Chrome builds without that update remain exposed.

Risk and Exploitability

The CVSS score is 9.6, indicating a high severity, and the EPSS score is < 1%. The vulnerability is not in the CISA KEV catalog. The attack can be delivered by a remote user who composes a malicious web page and lures a victim into visiting it. Because the flaw can escape the sandbox, successful exploitation could lead to full system compromise. Administrators should treat this as a priority issue.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Google Chrome update (≥152.0.7977.65).
  • Ensure Chrome automatic updates are enabled so future security patches are applied promptly.
  • If upgrading is delayed, restrict access to untrusted web content by enabling Safe Browsing and site isolation or by running Chrome in a confined virtual machine.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Thu, 27 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Out of Bounds Write in ANGLE Leading to Remote Code Execution in Google Chrome

Wed, 26 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Out of Bounds Write in ANGLE Leading to Remote Code Execution in Google Chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-787
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T03:57:33.865Z

Reserved: 2026-08-25T06:11:08.070Z

Link: CVE-2026-79188

cve-icon Vulnrichment

Updated: 2026-08-26T15:23:13.151Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:12.483

Modified: 2026-08-27T13:14:43.087

Link: CVE-2026-79188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:30:11Z

Weaknesses