CVE-2026-17790: Google Chrome ANGLE Information Disclosure

CVE-2026-17790 Overview

CVE-2026-17790 is an uninitialized memory use vulnerability [CWE-457] in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can leverage a crafted HTML page to read potentially sensitive information from process memory. Google classified the Chromium security severity as Medium.

ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls to native graphics APIs including Direct3D on Windows. Because ANGLE handles untrusted web content through WebGL, memory disclosure flaws in this component are reachable from any web page.

Critical Impact

Remote attackers can exfiltrate uninitialized process memory contents from Chrome renderer processes via crafted HTML, potentially leaking sensitive data across origins.

Affected Products

• Google Chrome on Windows prior to 151.0.7922.72
• ANGLE graphics component embedded in Chromium
• Chromium-based browsers on Windows using vulnerable ANGLE builds

Discovery Timeline

• 2026-07-30 - CVE-2026-17790 published to NVD
• 2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17790

Vulnerability Analysis

The vulnerability resides in ANGLE, which sits between Chrome's WebGL implementation and the underlying Windows graphics stack. ANGLE uses stack and heap allocations to hold graphics state, buffers, and intermediate translation data. When a code path reads from a variable or buffer before it is fully initialized, the process returns residual memory contents to the caller.

This class of flaw is tracked under CWE-457: Use of Uninitialized Variable. In a browser context, the caller may be JavaScript running WebGL operations on an attacker-controlled page. The returned bytes can contain fragments of prior allocations from the renderer process, including pointers, tokens, or cross-origin content.

Root Cause

The root cause is an ANGLE code path that consumes memory before assigning a deterministic value. On Windows, ANGLE's Direct3D or Vulkan backend allocates buffers to service graphics commands. If a specific sequence of WebGL calls reaches a branch that skips initialization, downstream reads propagate stale bytes into results that the renderer can expose to JavaScript.

Attack Vector

Exploitation requires only that the victim load an attacker-controlled HTML page in an unpatched Chrome build. The page issues a crafted sequence of WebGL calls that exercises the vulnerable ANGLE path. The attacker then reads back graphics resources such as textures, pixel buffers, or query results to extract uninitialized bytes.

Because the sink is inside the sandboxed renderer process, the disclosed memory is limited to that process. However, chained with other flaws, the leak can defeat address space layout randomization or expose secrets held in the renderer. Full technical details are available in the Chromium Issue Tracker Entry.

// No verified proof-of-concept code is available for CVE-2026-17790.
// The vulnerability is triggered by a crafted HTML page issuing WebGL
// calls that reach an ANGLE code path returning uninitialized memory.
// Refer to the Chromium Issue Tracker Entry for technical specifics.

Detection Methods for CVE-2026-17790

Indicators of Compromise

• Chrome browser processes on Windows running versions below 151.0.7922.72
• Renderer processes loading HTML pages that issue anomalous WebGL query patterns
• Outbound network traffic from browser sessions containing binary blobs resembling process memory fragments

Detection Strategies

• Inventory installed Chrome versions across Windows endpoints and flag any build older than 151.0.7922.72.
• Monitor for browser telemetry indicating GPU process crashes or ANGLE errors that may accompany exploitation attempts.
• Correlate web traffic logs with browser version data to identify unpatched clients visiting untrusted sites.

Monitoring Recommendations

• Enable enterprise Chrome update reporting to track patch rollout progress.
• Log DNS and HTTP requests from browser processes to identify visits to known malicious infrastructure.
• Track process memory anomalies in chrome.exe renderer children on Windows hosts.

How to Mitigate CVE-2026-17790

Immediate Actions Required

• Update Google Chrome on Windows to version 151.0.7922.72 or later on all endpoints.
• Force-restart Chrome sessions after deployment to ensure the patched binary is loaded.
• Audit Chromium-derived browsers such as Edge, Brave, and Opera for equivalent ANGLE updates.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Notice. Windows users should upgrade to Chrome 151.0.7922.72 or newer. Enterprise administrators can push the update through Google Update, group policy, or their endpoint management platform.

Workarounds

• Disable WebGL via the chrome://flags interface or enterprise policy HardwareAccelerationModeEnabled set to false if immediate patching is not possible.
• Restrict browsing to trusted sites through web filtering until patch deployment completes.
• Use site isolation and strict enterprise policies to reduce the value of leaked renderer memory.

# Verify Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy to disable hardware acceleration (registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f