CVE-2026-17801: Google Chrome ANGLE RCE Vulnerability

CVE-2026-17801 Overview

CVE-2026-17801 is an out-of-bounds read and write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the issue by serving a crafted HTML page to a target browser. Successful exploitation may allow a sandbox escape from the Chrome renderer process. Google classified the Chromium security severity as Medium.

Critical Impact
A crafted HTML page can trigger out-of-bounds memory access in ANGLE and potentially escape the Chrome sandbox, expanding attacker access from the renderer to the host environment.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable ANGLE builds
Applications using the affected ANGLE component through Chromium

Discovery Timeline

2026-07-30 - CVE-2026-17801 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17801

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the translation layer Chrome uses to map WebGL and other graphics API calls onto the host platform's GPU driver. ANGLE processes untrusted graphics commands that originate from web content in the renderer process. A crafted HTML page can drive ANGLE into an unsafe state where memory is read and written outside the bounds of an allocated buffer.

Because ANGLE code executes with more privileges than typical renderer JavaScript, memory corruption in this component can be chained with a renderer compromise to break out of the sandbox. The end result is that attacker-controlled logic runs outside the site-isolated renderer boundary.

Root Cause

The root cause is improper bounds checking in ANGLE when handling attacker-influenced graphics state. Both an out-of-bounds read and an out-of-bounds write are reachable through the affected code path. See the Chromium Issue Tracker Entry for further technical context.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build. No authentication is needed. The attacker delivers the payload through a controlled website, a compromised third-party resource, or a malicious advertisement. The crafted content issues WebGL or graphics API calls that reach the vulnerable ANGLE code path, triggering the out-of-bounds access and enabling a potential sandbox escape.

No verified public proof-of-concept code is available for this issue. Refer to the Chrome Release Update for vendor details.

Detection Methods for CVE-2026-17801

Indicators of Compromise

Chrome renderer or GPU process crashes with access-violation signatures shortly after loading unfamiliar web content.
Child processes spawned by chrome.exe that do not match expected Chromium process lineage.
Outbound connections from Chrome host processes to previously unseen domains following a browsing session.

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions and flag any build below 151.0.7922.72.
Monitor endpoint telemetry for anomalous behavior originating from Chrome renderer or GPU processes, including unexpected file writes and process creation.
Correlate browser crash dumps referencing ANGLE modules such as libGLESv2.dll or libEGL.dll with recent browsing activity.

Monitoring Recommendations

Ingest browser version telemetry into your SIEM or asset inventory and alert on out-of-date Chrome installations.
Track process ancestry for Chrome to identify sandbox escape attempts that spawn shells or scripting hosts.
Review web proxy logs for exposure to crafted or malicious HTML pages targeting WebGL and ANGLE.

How to Mitigate CVE-2026-17801

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Restart browser sessions after patch deployment to ensure the vulnerable ANGLE binaries are unloaded.
Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once vendors ship builds incorporating the ANGLE fix.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Chrome Release Update. Users running versions below 151.0.7922.72 should upgrade immediately. Enterprise administrators can push the update through Google's enterprise policies or endpoint management tooling.

Workarounds

Restrict access to untrusted websites through web filtering or DNS-based controls until patching completes.
Disable hardware-accelerated WebGL through enterprise policy where operationally acceptable to reduce ANGLE attack surface.
Enforce browser auto-update policies so future Chromium security fixes deploy without user action.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version