External risk intelligence

ANGLE Sandbox Escape in Google Chrome for Mac

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17695

This vulnerability is located within the web browser client (Google Chrome) and requires a user to navigate to a crafted HTML page to trigger the issue. Because it is a client-side application and not a network-facing service, appliance, or gateway, it lacks typical public-internet-facing exposure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in ANGLE within Google Chrome on Mac, identified by a high severity rating. The issue could potentially allow a remote attacker to escape the browser's sandbox through a malicious HTML page, leading to significant compromise if exploited. The main concern is confirming relevance and exposure to this type of threat.

Bug allows sandbox escape via web pages.
High severity, impacts user data and systems.
Verify if affected and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could start by tricking a user into visiting a specially crafted web page. This page would interact with the ANGLE component within the Google Chrome browser. If successful, the vulnerability could allow the attacker to escape the browser's security sandbox, potentially leading to a broader compromise of the user's system.

Requires visiting a malicious webpage.
Triggers vulnerability in ANGLE.
Risk of sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape vulnerability in ANGLE, a graphics engine used by Google Chrome, could allow a remote attacker to bypass security restrictions when a user visits a malicious HTML page. This could potentially affect the integrity and confidentiality of data and services within the browser's sandbox environment.

Browser sandbox integrity.
User visits crafted HTML page.
Potential for sandbox compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, affecting Google Chrome on Mac, requires immediate attention from teams responsible for endpoint security and browser management. The first critical step is to inventory all Mac systems running Chrome, confirm the presence of the vulnerable version, and assess business criticality and user exposure. Subsequently, coordinate with affected users or IT support to plan and execute remediation.

Endpoint security and browser management teams.
Verify Mac systems running vulnerable Chrome.
Plan and execute targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ANGLE in Google Chrome?

ANGLE (Almost Native Graphics Layer Engine) is a software component that translates various graphics API calls, like OpenGL, into the native graphics language supported by a user's operating system. In Google Chrome for Mac, it serves as an essential bridge that ensures high-performance 3D graphics rendering across different hardware. Because it handles complex graphical data processing, it operates within the browser's architecture to enable modern web experiences.

What does CWE-693 mean for CVE-2026-17695?

CWE-693 refers to Protection Mechanism Failure. In the context of this vulnerability, it means the security controls designed to keep the browser's processes contained have failed. Specifically, the flaw allows an attacker to break out of the browser's sandbox—a safety barrier that normally prevents web content from accessing your underlying system—effectively bypassing the intended security boundaries.

How is this sandbox escape triggered?

An attacker triggers this vulnerability by convincing a user to visit a specially crafted HTML page designed to exploit the ANGLE component. The vulnerability is not triggered by simply having the browser installed or running in the background. It specifically requires the execution of malicious code contained within a web page, which then manipulates the graphics engine to force the sandbox escape.

Is my Mac at risk according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability resides in the web browser client itself rather than an internet-facing network service or appliance. Because it requires a user to navigate to a specific malicious page, it lacks the typical exposure of a server-side bug. However, it remains relevant for any Mac users who browse the internet, as the risk depends on user interaction with untrusted or compromised websites.

Do I need to update my browser immediately?

Yes, you should verify if you are running a version of Google Chrome on Mac earlier than 151.0.7922.72. The most effective way to address this risk is to update the application to the patched version provided by the vendor. Prioritize identifying systems where Chrome is used frequently and ensure the update process is managed to maintain the integrity of your browser's security sandbox.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.