CVE-2026-17714: Google Chrome ANGLE Information Disclosure

CVE-2026-17714 Overview

CVE-2026-17714 is an uninitialized memory use vulnerability [CWE-457] in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can leverage a crafted HTML page to read potentially sensitive information from Chrome process memory. Chromium rates the security severity as High.

ANGLE (Almost Native Graphics Layer Engine) translates WebGL and OpenGL ES calls into native graphics API commands. Because ANGLE runs inside the renderer and GPU processes, memory disclosed through this bug can include state from those processes.

Critical Impact
Remote attackers can extract potentially sensitive data from Chrome process memory by luring a victim to a malicious web page.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers using the vulnerable ANGLE component
Embedded frameworks bundling pre-151 Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17714 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17714

Vulnerability Analysis

The vulnerability is classified under [CWE-457: Use of Uninitialized Variable]. ANGLE allocates memory to service WebGL and graphics API operations but reads from that memory before initializing all fields. When Chrome returns the resulting data to the caller, residual bytes from prior allocations are exposed.

The EPSS score for this issue is 0.314% with a percentile of 23.782, indicating a low observed likelihood of exploitation in the near term. The primary impact is information disclosure rather than code execution, though leaked memory contents may aid follow-on exploitation of other vulnerabilities by defeating address space layout randomization (ASLR).

Root Cause

The defect stems from ANGLE returning a memory buffer whose contents were not fully written by the producing code path. Depending on the specific API surface, this can expose pointers, texture data, shader state, or heap remnants that previously occupied the same allocation.

Attack Vector

Exploitation requires the victim to load an attacker-controlled HTML page in a vulnerable Chrome build. The page issues crafted WebGL or graphics operations that trigger the uninitialized read in ANGLE. Recovered bytes are relayed back to JavaScript for exfiltration. No authentication or user interaction beyond visiting the page is required.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Post for technical background.

Detection Methods for CVE-2026-17714

Indicators of Compromise

Browser process crashes or GPU process anomalies coinciding with visits to untrusted domains
Outbound HTTP POST traffic containing high-entropy binary blobs originating from browser tabs running WebGL content
Client telemetry showing Chrome versions below 151.0.7922.72 still active after the patch window

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag builds earlier than 151.0.7922.72
Inspect web proxy logs for pages combining WebGL context creation with obfuscated JavaScript exfiltration patterns
Correlate GPU or renderer process faults with concurrent network egress to newly registered domains

Monitoring Recommendations

Enable centralized browser telemetry to track Chrome version drift across the fleet
Alert on Chrome auto-update failures that leave endpoints on pre-151 builds
Monitor DNS and TLS SNI logs for repeated user visits to low-reputation domains hosting WebGL payloads

How to Mitigate CVE-2026-17714

Immediate Actions Required

Update Google Chrome for Desktop to 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Force restart of Chrome instances to complete the update after installation
Push equivalent patched builds for Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi once vendors release them

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Post. The upstream code change is tracked in the Chromium Issue Tracker Entry. Deploy the patched build through managed update channels such as Chrome Browser Cloud Management, Group Policy, Jamf, or Intune.

Workarounds

Disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths while patching is in progress
Restrict WebGL through enterprise policy for high-risk user populations until updates are verified
Enforce web filtering to block navigation to untrusted or newly registered domains that could host exploit pages

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Chrome enterprise policy to disable hardware acceleration (workaround)
# /etc/opt/chrome/policies/managed/hardware_accel.json
{
  "HardwareAccelerationModeEnabled": false
}