CVE-2026-17689 Overview
CVE-2026-17689 is an uninitialized memory use vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tracked under CWE-457 (Use of Uninitialized Variable). Chromium's internal security triage rated the severity as High, while the assigned CVSS 3.1 score is 4.3.
Critical Impact
Remote attackers can leak cross-origin data through a crafted HTML page rendered by a vulnerable Chrome instance, bypassing browser same-origin protections.
Affected Products
- Google Chrome Desktop versions prior to 151.0.7922.72
- ANGLE graphics component shipped with Chromium-based browsers
- Chromium-derived browsers integrating ANGLE builds prior to the fixed release
Discovery Timeline
- 2026-07-30 - CVE-2026-17689 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17689
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component that translates WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan commands. An uninitialized variable is used during graphics processing, producing output derived from residual memory contents.
Attackers craft an HTML page that triggers specific WebGL rendering paths in ANGLE. The uninitialized memory can contain fragments of data from other browsing contexts, including cross-origin resources loaded into the GPU process. Reading rendered pixels or querying graphics state returns attacker-observable data derived from that residual memory.
This breaks the same-origin policy enforced by the browser. Exploitation requires user interaction, limited to visiting a malicious page. The scope remains unchanged and only confidentiality is affected.
Root Cause
The defect is a [CWE-457] Use of Uninitialized Variable within ANGLE code paths. A buffer or variable used during graphics command translation or resource allocation is read before being fully initialized. Because the GPU process handles data from multiple origins, the stale memory contents can include cross-origin pixel data or state information.
Attack Vector
Exploitation requires a user to load an attacker-controlled HTML page in an unpatched Chrome build. The page issues WebGL or Canvas operations that reach the vulnerable ANGLE code path. The attacker reads back rendered output or queried state to recover cross-origin data. No authentication or elevated privileges are required.
The vulnerability is described in prose because no public proof-of-concept has been published. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update for vendor-provided technical context.
Detection Methods for CVE-2026-17689
Indicators of Compromise
- Chrome browser processes running versions prior to 151.0.7922.72 in enterprise environments
- Outbound connections from browser processes to unfamiliar domains following visits to untrusted sites
- Anomalous GPU process crashes or renderer restarts correlated with WebGL-heavy page loads
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
- Monitor endpoint telemetry for chrome.exe child processes generating cross-origin network requests immediately after WebGL activity
- Correlate browser telemetry with threat intelligence feeds identifying pages exploiting ANGLE flaws
Monitoring Recommendations
- Enable browser version reporting through enterprise management tools such as Chrome Browser Cloud Management
- Ingest browser and endpoint logs into a centralized data lake for version-drift analysis
- Alert on repeated GPU process crashes tied to specific origins, which can indicate attempted exploitation
How to Mitigate CVE-2026-17689
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
- Force browser restarts through endpoint management to ensure the patched build is loaded
- Review Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) for corresponding ANGLE patches
Patch Information
Google released the fix in Chrome stable channel version 151.0.7922.72. Details are documented in the Google Chrome Update release notes and the corresponding Chromium Issue Tracker Entry. Chromium-based browsers should incorporate the updated ANGLE component in their next stable release.
Workarounds
- Disable hardware acceleration in Chrome via chrome://settings to bypass ANGLE code paths, accepting performance impact
- Restrict access to untrusted web content using enterprise URL filtering until patching completes
- Deploy browser isolation for high-risk user groups to contain any potential cross-origin leakage
# Configuration example: Enforce minimum Chrome version via Group Policy on Windows
# Set the following registry value to require the patched build
reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumBrowserVersion /t REG_SZ /d "151.0.7922.72" /f
# Optionally disable hardware acceleration as a temporary workaround
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
