CVE-2026-7354: Google Chrome RCE Vulnerability

CVE-2026-7354 Overview

CVE-2026-7354 is an out-of-bounds read and write vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to the host system's graphics APIs. The flaw affects Google Chrome versions prior to 147.0.7727.138 on Windows, macOS, and Linux. A remote attacker can serve a crafted HTML page that triggers the memory corruption and potentially escape the Chrome sandbox. Google's Chromium project classifies the issue with High security severity, and the flaw is tracked under [CWE-125]. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page.

Critical Impact

Remote attackers can trigger out-of-bounds memory access in ANGLE through a crafted HTML page, potentially leading to a Chrome sandbox escape and execution outside the renderer's restricted environment.

Affected Products

• Google Chrome versions prior to 147.0.7727.138
• Chrome on Microsoft Windows, Apple macOS, and Linux
• Chromium-based browsers that embed the vulnerable ANGLE component

Discovery Timeline

• 2026-04-28 - CVE-2026-7354 published to NVD
• 2026-04-28 - Google releases stable channel update for desktop addressing the issue
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7354

Vulnerability Analysis

The vulnerability resides in ANGLE, the component that translates WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan operations depending on the host platform. ANGLE runs partially within the GPU process, which has reduced but still meaningful privileges relative to the renderer sandbox. An out-of-bounds read and write in this layer allows an attacker to access memory outside the bounds of an allocated buffer. Because ANGLE processes attacker-controlled shader programs and graphics commands originating from web content, malicious JavaScript or WebGL payloads can reach the vulnerable code path. The combination of read and write primitives makes this class of bug well suited for crafting reliable exploits that leak memory layout and then overwrite control data.

Root Cause

The root cause is improper validation of buffer boundaries within ANGLE's handling of graphics state or shader inputs, classified as [CWE-125] Out-of-Bounds Read. Specific technical details are restricted under Chromium's standard disclosure policy and are tracked in Chromium Issue Tracker #498746519. Access to the issue remains limited until the majority of users have updated.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page containing malicious WebGL or graphics API calls. When a victim using a vulnerable Chrome build visits the page, the rendering pipeline passes attacker-controlled data to ANGLE, triggering the out-of-bounds access. Chained with other primitives, this can enable a sandbox escape from the GPU process. See the Google Chrome Stable Channel Update for the official advisory.

Detection Methods for CVE-2026-7354

Indicators of Compromise

• Unexpected crashes or restarts of the Chrome GPU process (gpu-process) on endpoints, particularly correlated with web browsing activity
• Child processes spawned from chrome.exe that do not match expected Chromium process types or command-line arguments
• Outbound network connections from Chrome helper processes to uncommon destinations following visits to untrusted pages

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any instance below 147.0.7727.138 for remediation
• Monitor browser telemetry and crash reports for repeated ANGLE or GPU process faults that may indicate exploitation attempts
• Hunt for anomalous post-exploitation behavior such as renderer or GPU processes executing shell commands, writing to startup locations, or loading unsigned modules

Monitoring Recommendations

• Centralize Chrome version and crash telemetry into the SIEM to identify outdated installations and abnormal failure patterns at scale
• Correlate web proxy logs of visited URLs with endpoint process events to investigate clusters of GPU process crashes tied to specific domains
• Track execution lineage from browser child processes to detect privilege escalation or sandbox escape attempts following crafted content delivery

How to Mitigate CVE-2026-7354

Immediate Actions Required

• Update Google Chrome to version 147.0.7727.138 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after the update applies, since pending patches do not take effect until the browser is relaunched
• Apply equivalent updates to other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) once their vendors ship corresponding builds

Patch Information

Google published the fix in the Chrome Stable channel as version 147.0.7727.138 for desktop platforms. Full release details are available in the Chrome Stable Channel Update for Desktop. Enterprise administrators should deploy the patch through managed update infrastructure such as Group Policy, Jamf, or Chrome Browser Cloud Management.

Workarounds

• Enforce automatic Chrome updates through enterprise policy to reduce exposure windows for browser vulnerabilities
• Restrict access to untrusted websites via web filtering or DNS-based controls until patching is verified across the environment
• Disable hardware acceleration in Chrome (chrome://settings → System) as a temporary measure to reduce ANGLE attack surface, accepting the performance trade-off

# Configuration example: enforce minimum Chrome version via policy (Linux)
# /etc/opt/chrome/policies/managed/chrome_version_policy.json
{
  "TargetVersionPrefix": "147.0.7727.138",
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true
}