CVE-2026-17718: Google Chrome ANGLE Use-After-Free Flaw

CVE-2026-17718 Overview

CVE-2026-17718 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the issue by serving a crafted HTML page, potentially leading to a sandbox escape from the Chrome renderer process. Chromium engineers classified the security severity as High. The weakness is tracked as [CWE-416: Use After Free].

Critical Impact
Successful exploitation via a crafted HTML page can allow a remote attacker to escape the Chrome sandbox, breaking a core browser security boundary.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
ANGLE component (Almost Native Graphics Layer Engine) shipped with Chromium
Chromium-based browsers that embed the vulnerable ANGLE build

Discovery Timeline

2026-07-30 - CVE-2026-17718 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17718

Vulnerability Analysis

The vulnerability resides in ANGLE, the graphics translation layer that converts WebGL and OpenGL ES commands into calls for native GPU APIs such as Direct3D, Metal, or Vulkan. A use-after-free condition occurs when ANGLE releases a graphics object while a reference to it remains reachable from another execution path. Subsequent access to the freed memory produces undefined behavior that an attacker can shape into a controlled read or write primitive.

Because WebGL surfaces ANGLE functionality directly to untrusted JavaScript, a crafted HTML page can trigger the vulnerable code path without any user interaction beyond visiting a page. Chromium reports this issue as a potential sandbox escape, meaning exploitation could allow code running in the renderer process to break out of its restricted sandbox boundary.

Root Cause

The root cause is improper object lifetime management within ANGLE. A graphics resource is freed while a dangling pointer or handle remains in use elsewhere in the pipeline. When the attacker forces reuse of the freed allocation with attacker-controlled data, control-flow or data-flow hijacking becomes feasible.

Attack Vector

Delivery occurs over the network through any web content the victim renders. An attacker hosts a malicious page containing JavaScript that issues a specific sequence of WebGL calls designed to reach the vulnerable ANGLE code path. See the Chromium Issue Tracker #522079372 and the Google Chrome Desktop Update for vendor-provided context. No public proof-of-concept code has been released.

Detection Methods for CVE-2026-17718

Indicators of Compromise

Chrome renderer or GPU process crashes with heap corruption signatures on hosts visiting untrusted pages
Unexpected child processes spawned by chrome.exe following browser sessions to unknown domains
Outbound connections from browser processes to newly registered or low-reputation domains hosting WebGL-heavy content

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
Monitor endpoint telemetry for anomalous behavior originating from Chrome renderer or GPU processes, including unexpected memory allocations and process injection attempts
Correlate browser crash dumps referencing libGLESv2 or ANGLE modules with recent navigation history

Monitoring Recommendations

Enable browser crash reporting and forward reports to a central SIEM for correlation
Track process lineage from Chrome to identify sandbox escape follow-on activity such as shell spawns or credential access
Alert on Chrome processes writing to unusual filesystem locations or loading unsigned modules

How to Mitigate CVE-2026-17718

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after patching to ensure the vulnerable ANGLE library is unloaded from memory
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or existing software distribution platforms

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Desktop Update. Chromium-derived browsers such as Microsoft Edge, Brave, and Opera should be updated once their maintainers integrate the corresponding ANGLE fix.

Workarounds

Disable hardware acceleration in Chrome settings to reduce reliance on ANGLE and WebGL rendering paths where feasible
Enforce the HardwareAccelerationModeEnabled policy set to false for high-risk user groups until patching is complete
Restrict access to untrusted web content through enterprise browsing policies or isolation technologies until updates are deployed

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Example enterprise policy to disable hardware acceleration (Linux JSON policy)
# /etc/opt/chrome/policies/managed/disable_hwaccel.json
{
  "HardwareAccelerationModeEnabled": false
}