CVE-2026-17678: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17678 Overview

CVE-2026-17678 is an out-of-bounds read vulnerability [CWE-125] in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to underlying platform APIs. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium project rated the security severity as High.

Critical Impact
An attacker with renderer process control can chain this out-of-bounds read to escape the Chrome sandbox, breaking a core boundary of the browser security model.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers incorporating vulnerable ANGLE builds
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-07-30 - CVE-2026-17678 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17678

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component that Chrome uses to translate WebGL and OpenGL ES commands to platform graphics APIs such as Direct3D, Metal, or Vulkan. An out-of-bounds read [CWE-125] occurs when ANGLE reads memory beyond the intended buffer boundary while processing attacker-influenced graphics operations. The disclosed data can include pointers, object metadata, or other sensitive process state.

This flaw alone does not grant initial code execution. Instead, it serves as a secondary primitive: an attacker who has already achieved code execution inside the renderer process uses the leak to defeat mitigations such as ASLR, or to probe object layouts required for a sandbox escape. ANGLE runs in a privileged GPU process context, making it a valuable pivot target from the sandboxed renderer.

The EPSS model estimates a probability of 0.288% (percentile 21.023) for exploitation activity in the near term.

Root Cause

The root cause is missing or incorrect bounds validation on input data processed by ANGLE. When the renderer supplies crafted graphics state or command buffers, ANGLE dereferences memory outside the allocated region. See the Chromium Issue Tracker Entry for upstream context.

Attack Vector

Exploitation requires two stages. First, the attacker must compromise the renderer process, typically through a separate memory corruption bug triggered by a malicious web page. Second, the attacker delivers a crafted HTML page that issues specific WebGL or graphics API calls to trigger the out-of-bounds read in ANGLE. The leaked information supports a sandbox escape into the more privileged GPU or browser process.

No verified public proof-of-concept code is available. Refer to the Chrome Releases Update Announcement for vendor details.

Detection Methods for CVE-2026-17678

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 after the patch release date
Unexpected GPU process crashes or termination events correlated with browsing sessions
Renderer processes spawning child processes or performing outbound connections inconsistent with normal browser behavior

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag any build below 151.0.7922.72.
Monitor for anomalous process lineage originating from chrome.exe renderer or GPU processes, including unexpected shell or scripting host children.
Correlate browser crash dumps referencing ANGLE modules (libGLESv2.dll, libEGL.dll) with subsequent suspicious process activity.

Monitoring Recommendations

Ingest endpoint telemetry covering process creation, module loads, and browser crash events into a centralized analytics platform.
Alert on Chrome renderer or GPU processes performing file writes to autostart locations or loading unsigned modules.
Track outbound network connections from browser child processes to low-reputation destinations following crash events.

How to Mitigate CVE-2026-17678

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after applying the update to ensure the patched ANGLE libraries are loaded.
Audit Chromium-based browsers, including Microsoft Edge, Brave, and Opera, and apply corresponding vendor patches once available.

Patch Information

Google released the fix in the Chrome Stable channel with version 151.0.7922.72. The patch corrects the bounds handling in ANGLE that permitted the out-of-bounds read. Full release details are documented in the Chrome Releases Update Announcement, and the upstream tracking issue is available at the Chromium Issue Tracker Entry.

Workarounds

Disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths until the patch is deployed.
Enforce site isolation and restrict WebGL access on high-risk endpoints through enterprise policy.
Deploy browser update policies via Group Policy or MDM to guarantee prompt patch delivery across the fleet.

bash

# Enterprise policy example: disable hardware acceleration and force auto-update
# Windows registry (HKLM)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f

# Verify installed Chrome version on Linux
google-chrome --version