CVE-2026-91720: Google Chrome ANGLE Information Disclosure

CVE-2026-91720 Overview

CVE-2026-91720 is an uninitialized resource vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction component used by Google Chrome to translate WebGL and other graphics API calls. The flaw affects Google Chrome versions prior to 153.0.8010.47 and allows a remote attacker to read memory outside the browser sandbox by serving a crafted HTML page. Chromium engineers rated the security severity as High, though the assigned CVSS base score is 4.7 (Medium) because exploitation requires user interaction and only affects confidentiality. The weakness is classified under [CWE-908: Use of Uninitialized Resource].

Critical Impact
Remote attackers can read process memory outside the sandbox boundary through a malicious web page, potentially disclosing sensitive data from the renderer or adjacent components.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.47
Chromium-based browsers embedding the vulnerable ANGLE component
Downstream applications relying on the same ANGLE build for WebGL rendering

Discovery Timeline

2026-09-15 - CVE-2026-91720 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91720

Vulnerability Analysis

The vulnerability resides in ANGLE, the component that maps WebGL and other graphics API calls to native backends such as Direct3D, Metal, OpenGL, or Vulkan. ANGLE uses an uninitialized resource during graphics processing, causing memory contents that were never explicitly cleared to be returned to the calling context. An attacker who convinces a user to load a crafted HTML page can trigger graphics operations that surface this residual memory. Because ANGLE operates on data crossing the sandbox boundary, the disclosed bytes can originate from memory regions the untrusted renderer should not be able to observe. The issue does not directly enable code execution or data tampering, but it undermines the confidentiality guarantees the Chrome sandbox is designed to enforce.

Root Cause

The defect is a Use of Uninitialized Resource ([CWE-908]) inside ANGLE. A graphics buffer, texture, or output structure is allocated and returned without being fully initialized to a known value. Any bytes left over from prior allocations become readable through legitimate graphics API calls, giving JavaScript-driven WebGL workloads a side channel into memory that should be opaque.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must load attacker-controlled HTML, typically by visiting a malicious site, opening a compromised page in a legitimate site, or rendering hostile content inside an embedded frame or advertisement. The page issues WebGL or related graphics API calls that reach the vulnerable ANGLE code path and read back the uninitialized resource. No credentials or prior access are required.

No public proof-of-concept or exploit code is available at the time of publication. Technical specifics are tracked in the Chromium Issue Tracker #523470135.

Detection Methods for CVE-2026-91720

Indicators of Compromise

Chrome browser processes reporting version strings below 153.0.8010.47 in endpoint inventory data.
Renderer processes making unusually large or repeated WebGL readback calls from untrusted origins.
Web traffic to newly registered domains hosting pages that aggressively instantiate WebGL contexts and read pixel or buffer data.

Detection Strategies

Inventory browser versions across the fleet and flag any Chrome installation below the patched build 153.0.8010.47.
Correlate browser telemetry with proxy logs to identify sessions where users loaded uncategorized or newly observed domains immediately before anomalous browser behavior.
Monitor for renderer process crashes or memory faults referencing ANGLE modules such as libGLESv2 or libEGL, which can indicate exploitation attempts.

Monitoring Recommendations

Enable centralized browser management (Chrome Enterprise policies) to report installed versions and update status.
Ingest web proxy, DNS, and endpoint browser telemetry into a centralized analytics platform to hunt for suspicious WebGL activity against unpatched hosts.
Track Google Chrome release notes and the Google Chrome Stable Update advisory for follow-on fixes affecting ANGLE.

How to Mitigate CVE-2026-91720

Immediate Actions Required

Update Google Chrome to version 153.0.8010.47 or later on all managed endpoints.
Restart Chrome after the update so the patched binaries and ANGLE libraries are loaded into memory.
Prioritize updates for high-risk users such as executives, developers, and privileged administrators who routinely browse untrusted content.

Patch Information

Google addressed CVE-2026-91720 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Users should confirm the running version is 153.0.8010.47 or higher via chrome://settings/help. Vendors shipping Chromium-based products should rebase to the corresponding upstream release and redistribute updates to their customers.

Workarounds

Where immediate patching is not possible, disable WebGL in Chrome by setting the chrome://flags/#disable-webgl flag or applying the HardwareAccelerationModeEnabled enterprise policy to reduce exposure.
Restrict access to untrusted web content through enterprise web filtering, blocking newly registered and uncategorized domains.
Encourage users to avoid loading unknown web pages until the update is deployed across the fleet.

bash

# Verify Chrome version on Windows via PowerShell
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version