CVE-2026-17668: Google Chrome ANGLE Information Disclosure

CVE-2026-17668 Overview

CVE-2026-17668 is an uninitialized memory use vulnerability in ANGLE, the graphics abstraction layer that translates OpenGL ES API calls to native graphics APIs in Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. Google's Chromium project rated the security severity as High. The weakness is classified under CWE-457: Use of Uninitialized Variable. Exploitation requires only that the victim load an attacker-controlled page, making browser-based delivery straightforward through malicious sites, malvertising, or compromised third-party content.

Critical Impact
A remote attacker can leak cross-origin data from the browser by luring a user to a crafted HTML page, bypassing the same-origin policy that isolates web content.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable ANGLE component
Applications relying on the affected ANGLE graphics translation layer

Discovery Timeline

2026-07-30 - CVE-2026-17668 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17668

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which translates WebGL and OpenGL ES calls into platform-native graphics APIs such as Direct3D, Metal, or Vulkan. ANGLE processes GPU commands, shaders, and texture data on behalf of untrusted web content. When ANGLE reads from a memory location that was never initialized, the resulting value can contain residual data from other browser contexts. An attacker who controls the shader or WebGL input can direct that uninitialized value into a readable channel, such as a rendered pixel or a queried GPU resource. This behavior enables the exfiltration of data that should remain isolated by the same-origin policy. The EPSS score is 0.314% with a percentile of 23.781, reflecting the current external-exploitation likelihood estimate at publication.

Root Cause

The root cause is failure to initialize a variable or memory region within ANGLE before it is consumed by subsequent operations [CWE-457]. Uninitialized memory in graphics pipelines is particularly impactful because GPU buffers, textures, and shader inputs are frequently reused across origins and processes. Reading from unset memory allows content from one origin to reappear inside another rendering context.

Attack Vector

The attack vector is remote and network-based. An attacker hosts a crafted HTML page containing WebGL, Canvas, or other graphics operations that exercise the vulnerable ANGLE code path. When a victim visits the page, ANGLE processes the attacker-supplied graphics workload and returns uninitialized memory contents through pixel reads or shader outputs. The attacker then reads those values back through standard web APIs, extracting cross-origin data. No authentication is required and user interaction is limited to loading the page.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for authoritative technical details.

Detection Methods for CVE-2026-17668

Indicators of Compromise

Chrome browser instances running versions earlier than 151.0.7922.72 in enterprise inventories
Outbound requests to unfamiliar domains immediately following WebGL-heavy page loads
Web content invoking unusual sequences of readPixels, framebuffer reads, or shader queries against cross-origin resources

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions using endpoint management telemetry and flag any build below 151.0.7922.72
Correlate browser process telemetry with network egress to identify pages that trigger GPU workloads followed by data uploads to attacker-controlled infrastructure
Monitor browser crash and GPU-process error reports, which can indicate probing of uninitialized memory conditions

Monitoring Recommendations

Ingest Chrome update state, extension inventory, and version data into a centralized data lake for continuous exposure tracking
Alert on end-user browsers that repeatedly defer or block Chrome auto-updates past vendor patch release
Track HTTP referrers and DNS lookups from browser processes to identify high-risk pages hosting crafted WebGL content

How to Mitigate CVE-2026-17668

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart browser processes after patch deployment to ensure the vulnerable ANGLE library is unloaded from memory
Audit Chromium-based browsers and embedded webviews for the presence of the vulnerable ANGLE version and update accordingly
Communicate the update requirement to remote and BYOD users who manage their own browser installations

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. Upgrading Chrome to 151.0.7922.72 or later remediates CVE-2026-17668. Enterprise administrators can deploy the update through Google Update, managed software distribution, or MDM policies that enforce minimum browser versions.

Workarounds

Enforce Chrome auto-update policies through group policy or MDM to guarantee timely deployment of the fix
Restrict access to untrusted web content through DNS filtering and secure web gateways until patching completes
Disable hardware-accelerated graphics through the --disable-gpu flag as a temporary reduction of ANGLE code path exposure, accepting the performance impact

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Enforce minimum version via Chrome enterprise policy (Linux example)
cat <<EOF > /etc/opt/chrome/policies/managed/chrome_min_version.json
{
  "BrowserSwitcherEnabled": false,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}
EOF