CVE-2026-17683: Google Chrome ANGLE Information Disclosure

CVE-2026-17683 Overview

CVE-2026-17683 is an information disclosure vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. Versions prior to 151.0.7922.72 allow a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Google's Chromium project rated the security severity as High.

ANGLE translates OpenGL ES API calls to native hardware-supported APIs such as Direct3D, Vulkan, or Metal. It underpins WebGL rendering in Chrome and other Chromium-based browsers. An inappropriate implementation in this component exposes memory contents to attacker-controlled web pages.

Critical Impact
A remote attacker can read potentially sensitive information from Chrome's process memory by convincing a user to visit a crafted HTML page.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable ANGLE component
Desktop stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17683 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17683

Vulnerability Analysis

The vulnerability resides in ANGLE, the graphics abstraction layer that Chrome uses to service WebGL and other GPU-accelerated web APIs. An inappropriate implementation in ANGLE lets a crafted HTML page read data from Chrome process memory that should not be exposed to web content.

The exposed memory may contain fragments of prior GPU operations, browser state, or other in-process data. Web pages that invoke WebGL calls in a specific sequence can trigger the flaw and read back uninitialized or improperly bounded memory regions. This falls under the Information Exposure class of weaknesses.

The issue does not appear to grant code execution on its own. However, leaked memory can weaken exploit mitigations such as ASLR or expose tokens and cross-origin content useful in chained attacks.

Root Cause

The root cause is an inappropriate implementation within ANGLE's handling of graphics operations. Chrome release notes and the Chromium issue tracker entry 516887576 reference the defect without disclosing full technical detail while patched builds roll out.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers JavaScript and WebGL content that drives ANGLE into the vulnerable state and returns memory contents to attacker-controlled script. No authentication is required, and user interaction is limited to visiting the page.

The vulnerability manifests through JavaScript and WebGL API calls processed by ANGLE. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for release details.

Detection Methods for CVE-2026-17683

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints
Web pages that repeatedly invoke unusual WebGL draw and readback sequences from untrusted origins
Outbound requests exfiltrating opaque binary blobs immediately following WebGL activity

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
Monitor browser telemetry and endpoint logs for Chrome renderer crashes tied to libGLESv2 or ANGLE modules
Correlate DNS and proxy logs for user visits to newly registered or low-reputation domains hosting WebGL content

Monitoring Recommendations

Enable browser update compliance reporting in enterprise management tooling
Alert on unpatched Chrome installations reported by asset inventory or EDR agents
Review web proxy logs for high-volume WebGL traffic from unclassified sites

How to Mitigate CVE-2026-17683

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched ANGLE binary is loaded into memory
Verify Chromium-based browsers such as Edge, Brave, and Opera have applied the equivalent upstream fix

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Google Chrome Update Announcement. Administrators should push version 151.0.7922.72 or later through enterprise update channels.

Workarounds

Disable hardware acceleration in Chrome to reduce ANGLE code paths exercised by web content, accepting a performance trade-off
Use enterprise policy to block WebGL on untrusted sites where feasible
Restrict browsing to trusted origins via URL allow-lists until patching is complete

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version