CVE-2026-17717: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17717 Overview

CVE-2026-17717 is an integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer used by Google Chrome. The flaw exists in Chrome versions prior to 151.0.7922.72 and can be triggered by a crafted HTML page. A remote attacker can leverage the overflow to potentially escape the Chrome sandbox. Google's Chromium team classified the security severity as High. The issue is tracked under CWE-190: Integer Overflow or Wraparound.

Critical Impact
Successful exploitation may allow a remote attacker to escape the Chrome sandbox through a crafted HTML page, breaking a core browser security boundary.

Affected Products

Google Chrome versions prior to 151.0.7922.72
ANGLE graphics translation component within Chromium
Chromium-based browsers that ship the vulnerable ANGLE build

Discovery Timeline

2026-07-30 - CVE-2026-17717 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17717

Vulnerability Analysis

The vulnerability resides in ANGLE, the component that translates OpenGL ES API calls from WebGL and other Chrome graphics workloads into native graphics API calls such as Direct3D, Metal, or Vulkan. An integer overflow occurs during graphics data processing initiated from a web page. The overflow corrupts internal size or offset calculations, which can then be used to perform out-of-bounds memory operations in the GPU process.

Because ANGLE runs in the GPU process rather than the more restricted renderer sandbox, memory corruption here provides a stronger foothold. Chromium rated the security severity as High. The Exploit Prediction Scoring System places the near-term exploitation likelihood in the lower range, but sandbox-escape primitives in graphics stacks have historically been chained into full browser compromise.

Root Cause

The defect is an integer overflow (CWE-190) in ANGLE. Arithmetic on attacker-influenced size, count, or offset values wraps around the integer range, producing a smaller value than intended. Subsequent allocations or bounds checks that rely on the wrapped value permit memory access outside the intended buffer.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page delivers malformed graphics workloads, likely through WebGL or a related graphics surface, that reach the vulnerable ANGLE code path. No authentication is required, and the attacker only needs the user to visit an attacker-controlled or compromised site. The overflow is then leveraged to attempt a sandbox escape from the GPU process. See the Google Chrome update announcement and the Chromium issue tracker entry for vendor context.

No public proof-of-concept code is available. Technical details in the Chromium issue tracker remain restricted, which is standard practice while users migrate to the patched build.

Detection Methods for CVE-2026-17717

Indicators of Compromise

Chrome browser processes, particularly the GPU process (chrome.exe --type=gpu-process on Windows), crashing repeatedly after visiting a specific web page.
Endpoints still reporting Chrome versions earlier than 151.0.7922.72 in software inventory.
Unexpected child processes spawned by the Chrome GPU process, which should normally not create new processes.

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome or Chromium-based browser build below 151.0.7922.72.
Alert on anomalous process lineage where chrome.exe GPU child processes create shells, script interpreters, or unsigned binaries.
Correlate browser crash telemetry with outbound connections to newly observed domains loaded shortly before the crash.

Monitoring Recommendations

Ingest browser crash and Watchdog reports into a centralized log platform and baseline normal GPU process crash rates.
Monitor EDR telemetry for suspicious memory operations, injected threads, or token manipulation originating from Chrome GPU processes.
Track proxy and DNS logs for repeated visits to low-reputation domains that immediately precede Chrome process termination events.

How to Mitigate CVE-2026-17717

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Update Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi once their vendors ship builds that incorporate the ANGLE fix.
Force restart Chrome after deployment so the patched binaries are actually loaded into running sessions.
Verify patch adoption through endpoint software inventory rather than relying on user-driven updates.

Patch Information

Google released the fix in the Stable channel update announced in the Chrome Releases blog. The patched version is Chrome 151.0.7922.72. Additional detail, though partly restricted, is tracked in the Chromium issue tracker entry.

Workarounds

If patching cannot occur immediately, disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths, accepting the performance impact.
Restrict WebGL usage through enterprise policy on high-risk user groups until updates are deployed.
Apply network-layer controls to block access to untrusted sites for unpatched endpoints.

bash

# Enterprise policy example: disable hardware acceleration and WebGL via Chrome policy (Linux path shown)
# /etc/opt/chrome/policies/managed/cve-2026-17717.json
{
  "HardwareAccelerationModeEnabled": false,
  "WebGLEnabled": false,
  "DefaultBrowserSettingEnabled": true
}