CVE-2026-17704 Overview
CVE-2026-17704 is a use-after-free vulnerability [CWE-416] in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to platform-native graphics APIs. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Google's Chromium project rates the security severity as High. Successful exploitation moves an attacker from the restricted renderer context into a more privileged process, expanding access to the host system.
Critical Impact
Chained with a renderer compromise, this ANGLE use-after-free enables sandbox escape from a malicious web page, exposing the browser process and underlying operating system.
Affected Products
- Google Chrome Desktop versions prior to 151.0.7922.72
- Chromium-based browsers embedding vulnerable ANGLE builds
- Applications using Chromium Embedded Framework (CEF) with affected ANGLE code
Discovery Timeline
- 2026-07-30 - CVE-2026-17704 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17704
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which sits between Chrome's WebGL implementation and the underlying GPU driver. A use-after-free condition occurs when ANGLE code continues to reference a graphics resource object after that object has been released. An attacker who already controls the renderer process can manipulate ANGLE's object lifecycle through crafted graphics operations delivered via a malicious HTML page. Reclaiming the freed memory with attacker-controlled data enables corruption of function pointers or virtual table entries used within a higher-privilege context. This creates a pathway from the sandboxed renderer to the GPU or browser process, undermining Chrome's site isolation and sandbox boundaries. The EPSS probability sits at 0.288%, reflecting the requirement of an initial renderer compromise.
Root Cause
The defect stems from improper object lifetime management in ANGLE. A resource is freed while a reference to it remains reachable through ANGLE's internal state, allowing subsequent operations to dereference a dangling pointer. Refer to the Chromium Issue Tracker Entry for implementation-level context.
Attack Vector
Exploitation requires two stages. First, the attacker compromises the renderer process, typically via a separate memory-safety bug triggered by a malicious web page. Second, the attacker issues crafted graphics calls through the compromised renderer to reach the vulnerable ANGLE code path and trigger the use-after-free. The corrupted memory is then leveraged to execute code inside the GPU or browser process, achieving sandbox escape. See the Google Chrome Update Release for vendor guidance.
Detection Methods for CVE-2026-17704
Indicators of Compromise
- Unexpected child processes spawned by chrome.exe or the GPU process (--type=gpu-process) outside normal parent-child relationships.
- Crash telemetry referencing ANGLE modules (libGLESv2, libEGL) with access-violation signatures on freed heap regions.
- Outbound network connections initiated from the browser or GPU process to previously unseen infrastructure following visits to untrusted pages.
Detection Strategies
- Monitor Chrome process trees for anomalous code execution originating from gpu-process or renderer children performing file system or registry writes.
- Correlate browser crash reports containing ANGLE stack frames with subsequent process-injection or credential-access behavior.
- Alert on Chrome versions below 151.0.7922.72 reported by endpoint inventory queries.
Monitoring Recommendations
- Ingest browser telemetry and Windows Error Reporting data into a central analytics platform to surface repeated ANGLE crashes across the fleet.
- Track outbound connections and command-line arguments from Chrome child processes to detect post-exploitation staging.
- Enforce continuous version compliance checks for Chrome and Chromium-based browsers on managed endpoints.
How to Mitigate CVE-2026-17704
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
- Restart browser sessions after patch deployment to ensure the vulnerable ANGLE code is unloaded from memory.
- Inventory and patch third-party Chromium-based browsers and Electron or CEF applications that bundle ANGLE.
Patch Information
Google released the fix in the Chrome Stable channel with version 151.0.7922.72. Details are published in the Google Chrome Update Release. Chromium downstream vendors should incorporate the corresponding ANGLE commit referenced in the Chromium Issue Tracker Entry.
Workarounds
- Restrict access to untrusted websites through enterprise web filtering until patches are fully deployed.
- Disable hardware-accelerated WebGL where feasible by setting the Chrome policy HardwareAccelerationModeEnabled to false to reduce exposure of ANGLE code paths.
- Enforce site isolation and strict sandboxing policies through Chrome enterprise configuration.
# Configuration example: enforce minimum Chrome version via policy (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
# macOS: verify installed Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Linux: check package version
google-chrome --version | awk '{print $3}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
