CVE-2026-17740: Google Chrome ANGLE Information Disclosure

CVE-2026-17740 Overview

CVE-2026-17740 is an uninitialized memory use vulnerability [CWE-457] in ANGLE, the graphics abstraction layer used by Google Chrome to translate WebGL and other graphics API calls to native graphics drivers. The flaw affects versions of Google Chrome prior to 151.0.7922.72. A remote attacker can exploit the vulnerability by serving a crafted HTML page that triggers the use of uninitialized memory within ANGLE, leaking cross-origin data to the attacker. Google classifies the Chromium security severity as Medium.

Critical Impact
Successful exploitation allows a remote attacker to leak cross-origin data through a malicious web page, breaking the same-origin policy enforced by the browser.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable ANGLE component
Applications and embedded frameworks that rely on the affected ANGLE build

Discovery Timeline

2026-07-30 - CVE-2026-17740 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17740

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate OpenGL ES calls to platform-native graphics APIs such as Direct3D, Metal, and Vulkan. A code path within ANGLE reads from memory that was never initialized before use. When an attacker triggers this path through crafted graphics operations issued from JavaScript or WebGL on an HTML page, the browser processes stale memory contents as legitimate data. Those contents can include fragments of memory belonging to other origins loaded in the same renderer process, enabling cross-origin data disclosure.

Root Cause

The root cause is classified as [CWE-457] Use of Uninitialized Variable. A buffer, structure, or variable in ANGLE is consumed before all fields are explicitly initialized. Because the underlying memory can retain values from prior allocations, an attacker who controls allocation patterns can influence which residual data is exposed through graphics output or readback operations.

Attack Vector

Attack delivery is remote and requires the victim to load a crafted HTML page in a vulnerable Chrome build. No authentication is required. The attacker uses JavaScript, WebGL, or other web-exposed graphics APIs to reach the vulnerable ANGLE code path and to observe the leaked memory content through readback interfaces exposed to the page. See the Chrome Stable Channel Update and Chromium Issue Tracker #498827800 for vendor references.

No public proof-of-concept is available. The vulnerability mechanism is described in prose because no verified exploit code has been released.

Detection Methods for CVE-2026-17740

Indicators of Compromise

Chrome browser processes reporting version strings below 151.0.7922.72 in endpoint inventory data.
Renderer processes loading HTML pages that issue unusual sequences of WebGL calls followed by pixel or buffer readbacks to attacker-controlled domains.
Outbound HTTP requests carrying binary payloads shortly after WebGL activity from untrusted origins.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.72.
Monitor browser telemetry and proxy logs for renderer crashes or graphics errors originating from ANGLE during visits to low-reputation sites.
Correlate WebGL-heavy page loads from newly registered domains with subsequent outbound data transfers.

Monitoring Recommendations

Enable browser update reporting through enterprise management tools such as Chrome Browser Cloud Management.
Ingest browser process telemetry into the SIEM and alert on Chrome versions that fall out of the supported patch level.
Track access to sites categorized as anonymous, newly seen, or graphics-testing domains from managed endpoints.

How to Mitigate CVE-2026-17740

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Restart Chrome processes after update to ensure the patched ANGLE component is loaded.
Verify that Chromium-based browsers and embedded frameworks in the environment ship the fixed ANGLE build.

Patch Information

Google addressed the issue in Chrome Stable channel 151.0.7922.72. Refer to the Chrome Stable Channel Update for release details and to Chromium Issue Tracker #498827800 for the tracking entry.

Workarounds

Enforce automatic browser updates through enterprise policy so users receive the fix without manual intervention.
Restrict access to untrusted websites through web filtering until all endpoints are confirmed patched.
Consider disabling hardware-accelerated graphics via the HardwareAccelerationModeEnabled policy on high-risk endpoints as a temporary control while patches roll out.

bash

# Verify Chrome version on Windows
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version

# Verify Chrome version on macOS/Linux
google-chrome --version

# Expected output: Google Chrome 151.0.7922.72 or later