CVE-2026-17772: Google Chrome WebGL OOB Read Vulnerability

CVE-2026-17772 Overview

CVE-2026-17772 is an out-of-bounds read vulnerability [CWE-125] in the WebGL component of Google Chrome versions prior to 151.0.7922.72. A remote attacker can trigger the flaw by serving a crafted HTML page to a victim's browser. Successful exploitation allows the attacker to read memory outside the intended buffer boundaries within the renderer process. Google's Chromium security team rated this issue as Medium severity. The vulnerability affects the WebGL rendering pipeline, which processes untrusted graphics content from web pages.

Critical Impact
Remote attackers can read out-of-bounds memory in the Chrome renderer through a crafted HTML page delivered via WebGL.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected WebGL code
Applications embedding vulnerable Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17772 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17772

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Chrome's WebGL implementation. WebGL is the JavaScript API that exposes GPU-accelerated 2D and 3D rendering to web pages. When WebGL processes attacker-controlled graphics inputs, the affected code path reads memory beyond the bounds of an allocated buffer. This gives a remote attacker the ability to observe memory contents that should not be exposed to the renderer's JavaScript context.

Out-of-bounds reads in browser graphics stacks are commonly used to leak addresses, defeat Address Space Layout Randomization (ASLR), or reveal sensitive process memory. Attackers frequently chain such primitives with a separate memory-corruption bug to achieve renderer compromise. The Chromium project classifies the severity of this specific issue as Medium.

Root Cause

The root cause resides in the WebGL component's handling of buffer boundaries during rendering operations. The affected code fails to correctly validate an index or length before reading from a memory region, resulting in a read past the allocated buffer. Google has not released public technical details in the Chromium issue tracker entry beyond the summary. Refer to the Chromium Issue Tracker Entry for status information.

Attack Vector

Exploitation requires a victim to visit a malicious or compromised web page that serves crafted HTML and JavaScript exercising the vulnerable WebGL path. No authentication is required, and user interaction is limited to loading the page. The attack executes within the sandboxed renderer process, so the primary impact is information disclosure from renderer memory rather than direct code execution on the host.

See the Google Chrome Stable Update advisory for release-level details. No public proof-of-concept code is available at time of writing.

Detection Methods for CVE-2026-17772

Indicators of Compromise

Chrome browser processes reporting renderer crashes referencing WebGL or GPU components
Outbound connections from user endpoints to unknown domains hosting HTML pages with heavy WebGL content
Browser telemetry showing Chrome versions below 151.0.7922.72 still active in the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 151.0.7922.72
Monitor for anomalous renderer process crashes correlated with WebGL usage on suspicious domains
Inspect web proxy and DNS logs for user traffic to newly registered or low-reputation sites delivering WebGL payloads

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and alert on stale versions
Ingest browser and endpoint telemetry into a centralized data lake for correlation with URL reputation feeds
Establish baselines for renderer process behavior so out-of-bounds read attempts producing crashes stand out

How to Mitigate CVE-2026-17772

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Update all Chromium-based browsers and embedded Chromium runtimes once vendors ship the corresponding fix
Restart browser sessions after patch deployment to ensure the vulnerable code is no longer loaded

Patch Information

Google addressed the vulnerability in Chrome Stable 151.0.7922.72. Details of the fix are published in the Google Chrome Stable Update release notes. Administrators should push the update through enterprise Chrome update policies, MDM profiles, or software distribution tools. Chromium downstream vendors should ship their corresponding updates on release.

Workarounds

Disable WebGL through enterprise policy where the feature is not required for business workflows
Restrict browsing to trusted sites via allowlist policies until patching is complete
Use browser isolation or remote browser services for high-risk user populations

bash

# Enterprise policy example to disable WebGL via Chrome policy on Linux
cat <<EOF > /etc/opt/chrome/policies/managed/disable_webgl.json
{
  "HardwareAccelerationModeEnabled": false,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}
EOF