CVE-2026-17750 in Chrome
Summary
by MITRE • 07/30/2026
Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a use-after-free condition within the ANGLE graphics library component that forms part of Google Chrome's rendering stack. The issue arises when memory allocated to graphical objects is freed but subsequently accessed by malicious code, creating a potential pathway for arbitrary code execution. The vulnerability specifically affects Chrome versions prior to 151.0.7922.72 and was classified with a medium severity rating by Chromium security teams.
The technical flaw occurs within the ANGLE (Almost Native Graphics Layer Engine) implementation which translates OpenGL ES commands into DirectX operations on Windows platforms. When processing crafted HTML content containing malicious WebGL or graphics commands, the memory management system fails to properly track object references, allowing freed memory to be reused before proper cleanup occurs. This creates a classic use-after-free scenario where attackers can manipulate the memory layout to execute arbitrary code with the privileges of the Chrome process.
The operational impact of this vulnerability is significant as it enables remote code execution through web-based attacks without requiring user interaction beyond visiting a malicious webpage. The sandbox escape capability means that successful exploitation could bypass Chrome's security boundaries, potentially allowing attackers to access system resources, read sensitive data, or install malware on affected systems. This represents a critical concern for enterprise environments where users may inadvertently visit compromised websites.
The vulnerability aligns with CWE-416 which specifically addresses use-after-free conditions in memory management. From an ATT&CK perspective, this maps to technique T1059.007 for command and scripting interpreter, and potentially T1548.002 for privilege escalation through exploitation of software vulnerabilities. The attack vector typically involves crafting malicious HTML pages with embedded WebGL content that triggers the memory corruption during graphics processing.
Mitigation strategies include immediate patching to Chrome version 151.0.7922.72 or later where the vulnerability has been addressed through proper memory management corrections in the ANGLE component. Organizations should also implement additional security measures such as browser hardening, network-based protections, and monitoring for suspicious web traffic patterns. Regular security updates and patch management processes are essential to prevent exploitation of similar vulnerabilities in other components of the browser stack.