CVE-2026-17675: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17675 Overview

CVE-2026-17675 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google has classified this as High severity within its Chromium security ratings. The vulnerability is tracked under [CWE-787: Out-of-bounds Write].

Critical Impact
Successful exploitation enables a renderer-to-broker sandbox escape, allowing attacker code to execute outside Chrome's restricted rendering process and interact with the host operating system.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based components relying on the vulnerable ANGLE build
Downstream browsers embedding pre-151 Chromium releases

Discovery Timeline

2026-07-30 - CVE CVE-2026-17675 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17675

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls into platform-native graphics APIs such as Direct3D, Metal, or Vulkan. Chrome uses ANGLE to render WebGL and other GPU-accelerated content. An out-of-bounds write in this component allows attacker-controlled data to be placed outside allocated buffer boundaries.

Because ANGLE handles graphics commands originating from the renderer process, memory corruption within ANGLE can be reached from an already-compromised renderer. The attacker chains this issue with a prior renderer flaw to break out of Chrome's sandbox and reach higher-privileged process contexts.

Root Cause

The vulnerability stems from improper bounds checking during graphics operation handling inside ANGLE. Attacker-influenced input causes a write past the end of an intended buffer, corrupting adjacent memory structures. This corruption is used to redirect control flow or manipulate objects that operate at a higher privilege level than the renderer.

Attack Vector

Exploitation requires two stages. First, the attacker compromises the renderer process, typically through a separate memory-safety bug triggered by a crafted HTML page. Second, the attacker uses the ANGLE out-of-bounds write to escape the sandbox and gain broader execution capabilities on the host.

No verified proof-of-concept code is publicly available. Additional technical context is available in the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.

Detection Methods for CVE-2026-17675

Indicators of Compromise

Chrome renderer or GPU process crashes referencing ANGLE modules such as libGLESv2.dll or libEGL.dll
Unexpected child processes spawned from chrome.exe following a browsing session
Outbound connections initiated by Chrome helper processes to unfamiliar hosts after visiting untrusted content

Detection Strategies

Inventory endpoints running Chrome versions prior to 151.0.7922.72 using software asset management data
Alert on Chrome process trees that deviate from expected parent-child relationships, indicating potential sandbox escape
Correlate WebGL-heavy page loads with subsequent crash telemetry to identify possible exploitation attempts

Monitoring Recommendations

Ingest Chrome crash reports and GPU process logs into a centralized data platform for retrospective analysis
Track post-exploitation behaviors such as credential access, discovery commands, and persistence attempts originating from browser processes
Monitor for suspicious file writes or process injection performed by Chrome helper processes

How to Mitigate CVE-2026-17675

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after applying the update to ensure the patched ANGLE binaries are loaded
Verify that Chromium-based browsers and embedded frameworks used internally have been rebased on the patched release

Patch Information

Google released the fix in Chrome Stable 151.0.7922.72. Refer to the Google Chrome Update Announcement for complete release details and to the Chromium Issue Tracker Entry for the underlying bug reference.

Workarounds

Enforce automatic Chrome updates through enterprise policy so patched builds deploy without user action
Restrict access to untrusted web content on high-value endpoints until patching is verified
Consider disabling hardware-accelerated graphics temporarily where updates cannot be applied immediately, understanding this reduces but does not eliminate exposure

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version