CVE-2026-17785: Google Chrome ANGLE Information Disclosure

CVE-2026-17785 Overview

CVE-2026-17785 is an uninitialized memory use vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to platform-native graphics APIs. The flaw exists in Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this issue by serving a crafted HTML page that triggers the uninitialized use condition. Successful exploitation allows the attacker to leak cross-origin data, breaking the same-origin policy that isolates content between web origins. Google's Chromium project has rated this issue as Medium severity. The vulnerability is classified under CWE-457: Use of Uninitialized Variable.

Critical Impact
Remote attackers can leak cross-origin data by luring users to a crafted HTML page, bypassing browser same-origin isolation through ANGLE's uninitialized memory handling.

Affected Products

Google Chrome for Desktop prior to version 151.0.7922.72
Chromium-based browsers using ANGLE builds derived from the affected Chrome versions
Applications embedding affected Chromium builds via CEF or Electron

Discovery Timeline

2026-07-30 - CVE-2026-17785 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17785

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan commands on the host system. ANGLE processes graphics resources such as buffers, textures, and shader inputs on behalf of untrusted web content. When one of these resources is used before being fully initialized, its backing memory can contain residual data from prior allocations. That residual data may include contents drawn or computed from a different web origin. An attacker who reads back the uninitialized region through a WebGL API call can therefore observe cross-origin pixel or buffer contents. This defeats the same-origin policy that browsers rely on to keep site data isolated. The Chromium security team assigned the issue Medium severity, consistent with an information-disclosure flaw that requires user interaction with a malicious page.

Root Cause

The root cause is an uninitialized variable or graphics resource in ANGLE, tracked under CWE-457. A code path allocates or binds a GPU-backed resource without zeroing or otherwise initializing its contents before that resource becomes observable to JavaScript through the WebGL rendering pipeline.

Attack Vector

Exploitation requires the victim to load an attacker-controlled HTML page in an unpatched Chrome build. The page uses WebGL calls to trigger the vulnerable ANGLE code path, then samples the resulting buffer or texture to exfiltrate leaked bytes. No authentication or elevated privileges are required. Further technical details are tracked in the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.

Detection Methods for CVE-2026-17785

Indicators of Compromise

Endpoints running Google Chrome versions below 151.0.7922.72 after the patch release window
Browser telemetry showing navigation to unfamiliar domains hosting heavy or unusual WebGL workloads
Renderer processes producing repeated readPixels or getBufferSubData calls against freshly allocated resources

Detection Strategies

Inventory installed Chrome and Chromium-derivative browser versions across the fleet and flag any build older than 151.0.7922.72
Correlate web proxy logs with threat intelligence to identify user visits to pages known to serve WebGL-based exploit content
Alert on Electron or CEF applications shipping outdated ANGLE binaries that have not been rebased onto the fixed Chromium release

Monitoring Recommendations

Track Chrome auto-update status via management console reporting to confirm rollout of 151.0.7922.72 or later
Monitor for browser crash telemetry involving ANGLE modules such as libGLESv2.dll or libEGL.dll
Review DLP and egress logs for unexpected exfiltration patterns following visits to untrusted sites with rich graphics content

How to Mitigate CVE-2026-17785

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after update deployment so patched ANGLE libraries are loaded into new renderer processes
Identify and update Chromium-based applications, including Edge, Brave, Electron apps, and CEF-embedded software, once vendors ship rebased builds

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Details are published in the Google Chrome Update Announcement. Enterprise administrators should deploy the update through managed browser policies or standard patch management pipelines.

Workarounds

Disable WebGL through the --disable-webgl command-line flag or enterprise policy where graphics acceleration is not required
Restrict user browsing to trusted domains using URL allow-listing until patch deployment is verified
Enable Site Isolation and Strict Site Isolation policies to reduce the blast radius of cross-origin data leaks

bash

# Enforce minimum Chrome version and disable WebGL via enterprise policy (Windows registry example)
reg add "HKLM\Software\Policies\Google\Chrome" /v "WebGLEnabled" /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "IsolateOrigins" /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "SitePerProcess" /t REG_DWORD /d 1 /f