CVE-2026-17721: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17721 Overview

CVE-2026-17721 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES API calls to native graphics APIs. The flaw affects Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this issue by delivering a crafted HTML page to a target user. Successful exploitation may allow the attacker to perform a sandbox escape from the Chrome renderer process. Google's Chromium security team rated this issue as High severity.

Critical Impact
A crafted HTML page can trigger an out-of-bounds write in ANGLE, enabling a remote attacker to potentially escape the Chrome sandbox.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable ANGLE component
Applications using Chromium's ANGLE graphics translation layer

Discovery Timeline

2026-07-30 - CVE-2026-17721 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17721

Vulnerability Analysis

CVE-2026-17721 is classified under CWE-787 (Out-of-bounds Write). ANGLE (Almost Native Graphics Layer Engine) implements OpenGL ES on top of native graphics APIs such as Direct3D, Metal, and Vulkan. An out-of-bounds write in this component allows an attacker-controlled HTML page to write data outside the bounds of an allocated buffer during graphics processing.

Because ANGLE runs within the GPU process, memory corruption here provides a pathway out of the more restricted renderer sandbox. Successful exploitation could lead to a sandbox escape, giving the attacker code execution in a less-restricted process context.

Root Cause

The root cause is improper bounds checking within ANGLE when processing graphics operations initiated from a web page. Malformed WebGL calls, shader inputs, or texture parameters can cause ANGLE to write past the end of an allocated buffer. The exact triggering path is tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack vector is remote and requires user interaction. A victim must visit a malicious or compromised web page hosting the crafted content. The attacker uses WebGL or related graphics APIs exposed by the browser to reach the vulnerable ANGLE code path. No authentication is required, and drive-by exploitation is feasible for any user browsing with a vulnerable Chrome build.

No public proof-of-concept exploit code is currently available. Technical detail beyond Google's advisory is restricted pending broad user patching, per Chromium's standard disclosure policy. See the Chrome Stable Update Announcement for vendor details.

Detection Methods for CVE-2026-17721

Indicators of Compromise

Chrome GPU process crashes with access violation or heap corruption signatures preceded by WebGL activity
Unexpected child processes spawned by chrome.exe following visits to untrusted sites
Browser telemetry showing rendering of pages that invoke unusual WebGL shader compilations or texture uploads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor endpoint telemetry for anomalous behavior from the Chrome GPU process, including unexpected memory writes or crashes
Correlate web proxy logs with endpoint process events to identify users visiting suspicious sites immediately before browser crashes

Monitoring Recommendations

Enable centralized crash reporting for Chrome to surface GPU-process faults consistent with ANGLE memory corruption
Track browser version compliance through configuration management tooling and enforce automatic updates
Alert on post-exploitation behavior such as Chrome spawning cmd.exe, powershell.exe, or writing executables to disk

How to Mitigate CVE-2026-17721

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Restart browser sessions after updates to ensure the vulnerable ANGLE binary is unloaded
Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) receive corresponding upstream fixes

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Details are published in the Chrome Stable Update Announcement. Administrators should deploy this update through enterprise policy or Chrome's built-in updater. Chromium-derivative browsers typically merge the fix within days of upstream release.

Workarounds

Disable hardware acceleration in Chrome settings to reduce reliance on ANGLE code paths, understanding this degrades rendering performance
Restrict WebGL usage via enterprise policy where hardware acceleration cannot be disabled
Use browser isolation or remote browsing solutions for high-risk users until patches are fully deployed

bash

# Enterprise policy example to disable hardware acceleration on Windows
# HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f

# Verify installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv