CVE-2026-7903: Google Chrome ANGLE RCE Vulnerability

CVE-2026-7903 Overview

CVE-2026-7903 is an integer overflow vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer used by Google Chrome on Mac and Windows. The flaw affects Chrome versions prior to 148.0.7778.96. A remote attacker can trigger heap corruption by serving a crafted HTML page to a target browser. Successful exploitation requires user interaction, typically visiting an attacker-controlled web page. Chromium classifies the security severity as High. The weakness is tracked as [CWE-472] (External Control of Assumed-Immutable Web Parameter) in the NVD entry, though the underlying defect is an arithmetic overflow inside graphics command processing.

Critical Impact
Remote attackers can corrupt heap memory through a malicious web page, enabling potential arbitrary code execution within the Chrome renderer process.

Affected Products

Google Chrome on Windows prior to 148.0.7778.96
Google Chrome on macOS prior to 148.0.7778.96
ANGLE graphics component shipped with affected Chrome builds

Discovery Timeline

2026-05-06 - CVE-2026-7903 published to NVD
2026-05-06 - Last updated in NVD database
2026-05 - Google releases fix in Chrome Stable channel update

Technical Details for CVE-2026-7903

Vulnerability Analysis

ANGLE translates OpenGL ES API calls into native graphics calls on Direct3D, Metal, and Vulkan backends. Chrome uses ANGLE to implement WebGL and other GPU-accelerated web features. The vulnerability is an integer overflow in ANGLE that occurs when processing attacker-influenced graphics parameters supplied through web content.

When an integer value used for size or offset calculations exceeds the bounds of its type, the resulting wrapped value is used to allocate or index a heap buffer. Subsequent reads or writes operate on memory outside the intended allocation, producing heap corruption. The corrupted heap state is reachable from the Chrome renderer process, which handles untrusted web content.

Root Cause

The defect stems from arithmetic on untrusted size or count values inside ANGLE without sufficient bounds checking. WebGL exposes drawing, buffer, and texture APIs whose parameters are derived from JavaScript. When ANGLE multiplies or sums these values to compute allocation sizes or memory offsets, an overflow produces an undersized allocation or a wrapped index. Later code paths then write past the end of the allocated buffer.

Attack Vector

Exploitation requires only that a user navigates to a crafted HTML page. The page loads JavaScript that issues WebGL or related graphics calls with parameters chosen to trigger the overflow. No privileges or credentials are needed. The result is heap corruption inside the renderer process, which an attacker can chain with a sandbox escape to achieve full code execution on the host. See the Chromium Issue Tracker entry 491760376 and the Google Chrome Stable Update advisory for vendor details.

Detection Methods for CVE-2026-7903

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures, such as STATUS_HEAP_CORRUPTION on Windows or EXC_BAD_ACCESS on macOS, after visiting untrusted pages
Renderer crash dumps referencing ANGLE modules (libGLESv2.dll, libEGL.dll, or the equivalent macOS dylibs)
Outbound connections from chrome.exe or Google Chrome Helper (GPU) to unfamiliar domains shortly before or after a crash

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build prior to 148.0.7778.96
Monitor Chrome crash telemetry for repeated GPU or renderer faults clustered on specific URLs
Inspect web proxy logs for HTML pages that load WebGL contexts from low-reputation origins

Monitoring Recommendations

Forward browser crash events and process telemetry to a centralized analytics platform for correlation
Alert on child processes spawned by chrome.exe that perform file system or network actions inconsistent with normal browser behavior
Track WebGL-heavy navigations to newly registered domains as a higher-risk browsing pattern

How to Mitigate CVE-2026-7903

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all Windows and macOS endpoints
Restart browser sessions after the update so the patched ANGLE binaries are loaded
Verify enterprise update channels and management policies are not pinning Chrome to an older release

Patch Information

Google addressed CVE-2026-7903 in the Chrome Stable channel update documented in the Google Chrome releases blog. Administrators using Chrome Browser Cloud Management or Group Policy should confirm that auto-update is enabled and that the TargetVersionPrefix policy permits the patched build.

Workarounds

Disable hardware acceleration in chrome://settings to reduce ANGLE code path exposure until patching completes
Restrict WebGL on untrusted sites using enterprise policy or extensions that block GPU-accelerated graphics
Apply network-level controls to limit user navigation to vetted domains on hosts that cannot be updated immediately

bash

# Verify Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version