CVE-2026-17801 in Chrome
Summary
by MITRE • 07/30/2026
Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability identified as an out-of-bounds read and write in ANGLE within Google Chrome versions prior to 151.0.7922.72 represents a critical security flaw that could enable remote attackers to execute sandbox escape techniques through maliciously crafted HTML pages. This issue affects the ANGLE (Almost Native Graphics Library Engine) component which is responsible for graphics rendering operations in Chrome's architecture. The vulnerability stems from improper bounds checking within the graphics processing pipeline where memory access violations occur when handling certain graphical operations.
The technical implementation of this flaw involves ANGLE's handling of graphics commands and buffer management during rendering processes. When Chrome encounters specific HTML content that triggers certain WebGL or Direct3D operations, the underlying ANGLE library fails to validate array indices or buffer boundaries properly. This allows attackers to manipulate memory access patterns that extend beyond allocated memory regions, potentially enabling both read and write operations outside intended boundaries. The vulnerability operates at the graphics driver level where the abstraction layer between web content and native graphics APIs becomes compromised.
Operationally, this vulnerability creates a significant risk for users as it can be exploited through standard web browsing activities without requiring any special privileges or user interaction beyond visiting a malicious website. The sandbox escape capability means that successful exploitation could allow attackers to bypass Chrome's security model and potentially gain access to system resources or sensitive information. The medium severity classification by Chromium reflects the complexity required for exploitation, but the potential impact remains severe given the privileged nature of graphics rendering operations.
This vulnerability aligns with several CWE categories including CWE-129 for improper validation of array indices and CWE-787 for out-of-bounds write operations. From an ATT&CK framework perspective, this represents a technique for privilege escalation through exploitation of graphics rendering components, falling under the Tactic of Execution and Privilege Escalation. The attack vector typically involves crafting HTML pages with malicious WebGL or graphics commands that trigger the vulnerable code path in ANGLE's memory management subsystem.
Mitigation strategies include immediate upgrading to Chrome version 151.0.7922.72 or later where the vulnerability has been patched. Organizations should also implement network-level protections such as content filtering and web application firewalls to block known malicious domains. Browser security configurations can be enhanced by disabling unnecessary graphics features and implementing strict Content Security Policies. Additionally, regular security assessments of web applications and user education about avoiding untrusted websites remain crucial defensive measures against this class of vulnerabilities that target graphics rendering components in modern browsers.