CVE-2026-17667 Overview
CVE-2026-17667 is an uninitialized memory use vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. Chromium engineers classified the security severity as High. The weakness is tracked under CWE-457: Use of Uninitialized Variable.
Critical Impact
Remote attackers can bypass the same-origin policy and read cross-origin data by luring users to a malicious webpage that exercises the vulnerable ANGLE code path.
Affected Products
- Google Chrome desktop versions prior to 151.0.7922.72
- Chromium-based browsers embedding vulnerable ANGLE builds
- Downstream browsers that ship the pre-patch ANGLE component
Discovery Timeline
- 2026-07-30 - CVE CVE-2026-17667 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17667
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and OpenGL ES calls into platform-native graphics API commands such as Direct3D, Metal, or Vulkan. A code path in ANGLE consumes memory before it has been initialized. The uninitialized region can contain residual data from prior allocations in the renderer process. When a crafted HTML page invokes the affected graphics operation, the leaked bytes become observable to attacker-controlled JavaScript. Because Chrome renderers process content from multiple origins, the leaked bytes can include data belonging to a different origin than the attacker's page. This breaks the same-origin policy that browsers rely on to isolate web content.
Root Cause
The root cause is a missing initialization step in an ANGLE routine, categorized as CWE-457: Use of Uninitialized Variable. A buffer, structure, or texture-backing allocation is used before being explicitly zeroed or populated. Modern allocators reuse freed memory, so the uninitialized region often contains fragments of prior renderer state, including cross-origin resources decoded earlier in the process lifetime.
Attack Vector
Exploitation requires only that a target visit a webpage under attacker control or view attacker-controlled content embedded in another site. No authentication or user interaction beyond page navigation is required. The attacker embeds JavaScript and WebGL calls that trigger the vulnerable ANGLE path, then reads back the graphics buffer to reconstruct leaked cross-origin bytes. Refer to the Chromium Issue Tracker Entry for technical context.
No public proof-of-concept code is available. See the Google Chrome Update Announcement for vendor details.
Detection Methods for CVE-2026-17667
Indicators of Compromise
- Chrome desktop installations reporting a version string earlier than 151.0.7922.72 in browser telemetry or inventory data.
- Unexpected outbound requests from renderer processes to unfamiliar domains after WebGL-heavy page loads.
- Endpoint logs showing Chrome renderer processes accessing sensitive cached resources shortly before contacting attacker-controlled infrastructure.
Detection Strategies
- Inventory Chrome versions across managed endpoints and flag any host below 151.0.7922.72.
- Correlate web proxy logs with browser version data to identify users navigating to untrusted pages on outdated Chrome builds.
- Monitor for anomalous JavaScript execution patterns invoking WebGL APIs from newly observed domains, particularly domains with low reputation scores.
Monitoring Recommendations
- Track Chrome update rollout metrics against the Stable Channel release note and alert when patch coverage stalls.
- Enable browser reporting to a central SIEM so renderer crash and version data are searchable.
- Review threat intelligence feeds for URLs weaponizing ANGLE or WebGL memory disclosure primitives.
How to Mitigate CVE-2026-17667
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
- Restart Chrome after the update so the patched renderer and GPU processes take effect.
- Push the update through enterprise policy for users who have disabled automatic updates.
- Verify that Chromium-based browsers in the environment have absorbed the upstream ANGLE fix.
Patch Information
Google released the fix in the Chrome Stable Channel update documented in the Google Chrome Update Announcement. Upgrading to Chrome 151.0.7922.72 or later resolves CVE-2026-17667. Downstream Chromium-based browsers should merge the corresponding ANGLE commit referenced in the Chromium Issue Tracker Entry.
Workarounds
- Restrict WebGL by setting enterprise policy to disable hardware acceleration until Chrome is patched, accepting the performance tradeoff.
- Use browser isolation or remote browser services for users who browse untrusted content.
- Block known malicious domains at the web proxy and DNS layers to reduce initial access opportunities.
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS/Linux
google-chrome --version
# Group Policy: force automatic updates (Windows)
# HKLM\Software\Policies\Google\Update\AutoUpdateCheckPeriodMinutes = 60
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
