CVE-2023-1534: Google Chrome ANGLE RCE Vulnerability

CVE-2023-1534 Overview

CVE-2023-1534 is an out-of-bounds read vulnerability [CWE-125] in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer used by Google Chrome. The flaw affects Chrome versions prior to 111.0.5563.110. A remote attacker who has already compromised the renderer process can exploit heap corruption through a crafted HTML page. Google Chrome's security team rated the issue as High severity.

The vulnerability also impacts Fedora Linux distributions (versions 36, 37, and 38) that ship Chromium-based packages. Two public technical write-ups on Packet Storm document the underlying ANGLE defects in GL_ShaderBinary and SpvGetMappedSamplerName.

Critical Impact
An attacker who controls the renderer process can read out-of-bounds heap memory in ANGLE, enabling heap corruption and potential sandbox escape leading to code execution on the host.

Affected Products

Google Chrome versions prior to 111.0.5563.110
Fedora 36, 37, and 38 (Chromium packages)
Gentoo Linux (per GLSA 202309-17)

Discovery Timeline

2023-03-21 - CVE-2023-1534 published to the National Vulnerability Database (NVD)
2023-03-21 - Google releases Chrome 111.0.5563.110 Stable Channel update addressing the issue
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-1534

Vulnerability Analysis

The vulnerability resides in ANGLE, which translates OpenGL ES API calls into the underlying graphics APIs (Direct3D, Vulkan, Metal, or native OpenGL) on the host platform. Chrome uses ANGLE to implement WebGL inside the GPU process. An out-of-bounds read [CWE-125] in this code path allows an attacker controlling the renderer to read memory outside the bounds of an allocated buffer.

The bug class enables disclosure of adjacent heap memory and, when chained with proper allocator manipulation, can trigger heap corruption. Public reports on Packet Storm describe two related ANGLE issues: an untrusted process exposure through GL_ShaderBinary handling and an out-of-bounds string copy in SpvGetMappedSamplerName. Both involve insufficient validation of attacker-controlled shader or binary data before memory access.

Exploitation requires user interaction — typically loading a malicious HTML page that issues crafted WebGL calls. The renderer process must already be compromised to reach the vulnerable ANGLE code, making this a second-stage primitive in a typical browser exploit chain.

Root Cause

The root cause is missing or insufficient bounds checking in ANGLE's shader and binary parsing routines. The affected functions accept attacker-influenced size or index values and use them in memory reads without validating against the actual buffer length. The defect maps to CWE-125 (Out-of-bounds Read).

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts a crafted HTML page containing malicious WebGL content. When a victim using a vulnerable Chrome version visits the page, the JavaScript and shader payload reaches the renderer process. If the renderer has already been compromised through a separate bug, the attacker pivots into ANGLE to perform the out-of-bounds read and corrupt GPU process memory, escaping the renderer sandbox.

No verified proof-of-concept code is included here. Technical details are available in the Chromium Bug Report #1422594 and the Packet Storm advisory for GL_ShaderBinary.

Detection Methods for CVE-2023-1534

Indicators of Compromise

Chrome renderer or GPU process crashes with access violation signatures referencing libGLESv2, libANGLE, or shader-related symbols
Unexpected child processes spawned from chrome.exe immediately after WebGL-heavy page loads
Outbound connections to attacker-controlled hosts from machines running Chrome builds older than 111.0.5563.110

Detection Strategies

Inventory all endpoints to identify Chrome installations with versions earlier than 111.0.5563.110 using software asset management or EDR telemetry
Monitor browser process tree anomalies, particularly GPU process crashes followed by unexpected process creation or memory injection
Correlate web proxy logs with endpoint telemetry to identify users visiting low-reputation domains that serve WebGL or shader content

Monitoring Recommendations

Enable crash reporting and forward Chrome crash dumps to a central location for triage of ANGLE-related faults
Track browser version drift across the fleet and alert when endpoints fall behind the current Chrome Stable channel
Review GPU process behavior for anomalous memory allocations or file system access outside expected paths

How to Mitigate CVE-2023-1534

Immediate Actions Required

Update Google Chrome to version 111.0.5563.110 or later on all Windows, macOS, and Linux endpoints
Apply distribution updates for Fedora 36, 37, and 38, and Gentoo (GLSA 202309-17) where Chromium is installed from system packages
Force-restart Chrome browsers after deployment, since updates only take effect on relaunch
Verify update status across the fleet using management tooling rather than relying on end-user action

Patch Information

Google released the fix in the Chrome Stable channel update on March 21, 2023. See the Stable Channel Update for Desktop announcement. Linux distribution packages are tracked in the Fedora Package Announcement and Gentoo GLSA 202309-17.

Workarounds

Disable hardware acceleration in Chrome (chrome://settings → System → Use graphics acceleration when available) to reduce reliance on ANGLE code paths, accepting a performance impact
Block or restrict access to untrusted sites through web proxy or DNS filtering until patches are deployed
Enforce Chrome managed policies through Group Policy or MDM to require minimum browser version before granting network access

bash

# Example Chrome enterprise policy snippet (Linux JSON policy)
# /etc/opt/chrome/policies/managed/version-policy.json
{
  "HardwareAccelerationModeEnabled": false,
  "DefaultBrowserSettingEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}