CVE-2026-17691: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17691 Overview

CVE-2026-17691 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can trigger the memory corruption by serving a crafted HTML page to a target user. Google classifies the Chromium security severity as High. Successful exploitation can enable a sandbox escape, moving attacker-controlled code from the constrained renderer process into a more privileged context. The weakness is tracked as CWE-787, an out-of-bounds write.

Critical Impact
Remote attackers can potentially escape the Chrome sandbox on Windows through a crafted HTML page, breaking a core browser security boundary.

Affected Products

Google Chrome on Windows prior to 151.0.7922.72
ANGLE graphics component shipped with affected Chrome builds
Chromium-based browsers on Windows that embed the vulnerable ANGLE version

Discovery Timeline

2026-07-30 - CVE-2026-17691 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17691

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls into native graphics API calls on the host operating system. On Windows, ANGLE typically maps calls to Direct3D. Chrome uses ANGLE inside the GPU process to serve WebGL and other rendering workloads originating from web content. An out-of-bounds write in this component allows a malicious page to corrupt memory within a process that holds broader system access than the renderer sandbox. Because the GPU process brokers hardware-accelerated rendering, memory corruption there is a well-known path toward escaping the renderer sandbox.

Root Cause

The issue is an out-of-bounds write [CWE-787] in ANGLE. Boundary validation on a buffer, index, or offset fails before a write occurs, allowing data to be placed outside the intended allocation. Google has not published the specific ANGLE code path in the public advisory. Details are restricted in the Chromium Issue Tracker #517321292 until a majority of users have updated.

Attack Vector

Exploitation is remote and requires only that a user visit a crafted HTML page in an unpatched Chrome build on Windows. The page delivers WebGL or similar graphics operations that reach the vulnerable ANGLE code path. The initial memory corruption occurs in the renderer or GPU process. Chained with additional primitives, it can be used to break out of the renderer sandbox and execute code in a higher-privilege context on the host.

No verified public proof-of-concept code is available at the time of publication. See the Google Chrome Desktop Update for the vendor advisory.

Detection Methods for CVE-2026-17691

Indicators of Compromise

Chrome renderer or GPU process crashes on Windows endpoints correlated with visits to untrusted domains
chrome.exe child processes spawning unusual descendants such as cmd.exe, powershell.exe, or rundll32.exe
Outbound connections from Chrome GPU processes to non-standard hosts following a browsing event

Detection Strategies

Inventory installed Chrome versions across Windows fleets and flag any host running a build older than 151.0.7922.72
Alert on abnormal process lineage descending from chrome.exe, particularly from the GPU or renderer processes
Correlate Windows Error Reporting events for Chrome GPU crashes with browsing telemetry to surface targeted exploitation attempts

Monitoring Recommendations

Ingest browser version telemetry into your SIEM and build a dashboard for out-of-date Chrome installs
Monitor for WER dumps referencing libGLESv2.dll or ANGLE modules on Windows endpoints
Track egress from browser processes to newly registered or low-reputation domains hosting HTML with WebGL content

How to Mitigate CVE-2026-17691

Immediate Actions Required

Update Google Chrome on Windows to version 151.0.7922.72 or later across all managed endpoints
Force a browser restart after update deployment so the patched binaries load into memory
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) for vendor updates that incorporate the ANGLE fix

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Windows users must upgrade to 151.0.7922.72 or later. Enterprises using managed Chrome deployments should push the update through Group Policy, Chrome Browser Cloud Management, or their standard software distribution tooling.

Workarounds

Where immediate patching is not possible, disable hardware acceleration in Chrome to reduce exposure to ANGLE code paths
Restrict WebGL through enterprise policy for high-risk user groups until updates are deployed
Apply web filtering to block access to untrusted sites that could host exploit content

bash

# Verify installed Chrome version on Windows endpoints (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy example: disable hardware acceleration as a temporary workaround
# HKLM\SOFTWARE\Policies\Google\Chrome\HardwareAccelerationModeEnabled = 0
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f