External risk intelligence

ANGLE Sandbox Escape in Google Chrome

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17655

The vulnerability exists within the ANGLE graphics engine component of a web browser. Exploitation requires a user to navigate to a specifically crafted HTML page. As a client-side browser component, it is not a network-accessible service or internet-facing endpoint, and it lacks the characteristics of a public-facing gateway or server-side application.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within the ANGLE graphics component of Google Chrome. The issue involves insufficient validation of user-supplied input, which, if exploited through a specially crafted webpage, could allow an attacker to break out of the browser's security sandbox. While the technical impact is severe, the primary concern for leadership is to confirm whether this specific component is utilized in any relevant enterprise applications or services.

Input validation flaw in browser graphics engine.
Confirms exposure to a critical sandbox escape.
Assess relevance and confirm any exposure.

Attack Path

How an attacker could exploit the issue

An attacker could achieve a sandbox escape by enticing a user to visit a malicious HTML page. This page would interact with the ANGLE component in Google Chrome, exploiting insufficient validation of untrusted input. Successful exploitation could lead to broader system compromise beyond the browser's sandbox.

Requires user to visit a malicious page.
Exploits ANGLE's input validation.
Risk of sandbox escape and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to escape the browser sandbox when a user visits a specially crafted HTML page. This could lead to broader system compromise.

Browser sandbox escape.
Visiting malicious HTML page.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this vulnerability, teams responsible for endpoint security, application deployment, and browser management should take the lead. The immediate practical first step is to identify all endpoints running the affected browser version, assess their exposure to malicious websites, and confirm business criticality. Once identified, the accountable owner should be determined to prioritize and plan remediation, which may involve coordinated updates during scheduled maintenance windows.

Identify affected endpoints and owners.
Verify browser reachability and criticality.
Plan coordinated browser updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a graphics engine abstraction layer used by Google Chrome to translate web-based graphics calls into commands that the underlying hardware can understand. It acts as a bridge between the browser and your computer's graphics processing unit (GPU), ensuring that 3D content and complex visuals rendered on websites display correctly regardless of the specific graphics driver or operating system being used.

How does this CVE allow a sandbox escape?

This vulnerability relates to CWE-20, which covers improper input validation. Because the ANGLE component fails to properly inspect or filter incoming data, an attacker can send malicious input through a crafted HTML page. If the browser processes this data incorrectly, it may break the security sandbox—a restricted area designed to isolate web content—potentially granting the attacker unauthorized access to the host system.

Do I need to be logged into a site to be at risk?

No. The primary trigger for this vulnerability is navigating to a specially crafted webpage, not interacting with a specific service or account. You do not need to be authenticated or logged into any site for the risk to exist. Simply visiting the malicious site through the affected browser version provides the necessary conditions for the attack to occur.

Is this Chrome vulnerability an internet-facing risk?

According to Halo Surface Signal, this is considered very unlikely to be an internet-facing risk. Because the vulnerability resides in a client-side browser component, it is not a standalone network service or a gateway. It only poses a threat when an individual user intentionally or accidentally navigates to a malicious site, making it a desktop-level concern rather than a network-exposed server vulnerability.

How should I respond to CVE-2026-17655?

Your first step is to locate all endpoints within your environment that are running the affected versions of Google Chrome. Once these systems are identified, verify who owns these assets and determine their criticality to your operations. Prioritize these devices for a browser update to the secure version provided by Google to neutralize the sandbox escape risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.