External risk intelligence

ANGLE Sandbox Escape via HTML Page in Chrome

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-17801

The vulnerability affects a web browser, which is designed to process external, internet-sourced content by default. Because web browsers are routinely used to navigate public-facing websites, the attack surface is considered commonly exposed to internet-based threats.

Out-of-bounds Read

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in ANGLE, a component used in Google Chrome, that could allow a remote attacker to escape the browser's sandbox. This occurs through a specially crafted HTML page, potentially leading to unauthorized access and control. The main concern at this stage is confirming relevance and exposure to our environment.

Code flaw allows attackers to break browser security.
Affects widely used internet browsing technology.
Confirm if this affects our systems.

Attack Path

How an attacker could exploit the issue

A remote attacker could trick a user into visiting a malicious web page, which then exploits a flaw in ANGLE, a component within Google Chrome, potentially leading to a sandbox escape. This means an attacker might be able to break out of the browser's restricted environment to affect the user's system.

Requires user to visit a crafted page.
Vulnerability in ANGLE component.
Allows sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape vulnerability in ANGLE could allow a remote attacker to execute arbitrary code when a user visits a malicious HTML page. This could potentially impact the confidentiality and integrity of data processed within the browser's sandbox environment.

Browser sandbox integrity.
Malicious HTML page execution.
Potential sandbox escape.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, which impacts Google Chrome, likely requires coordination between application owners who manage web content, infrastructure teams responsible for the browser deployments, and security teams to assess exposure and manage remediation. The first practical step is to identify all instances of the affected Chrome version, determine if they are accessible from the internet or handle sensitive data, and then identify the accountable owner for each instance to plan mitigation.

Application and Infrastructure teams own the issue.
Verify browser reachability and business criticality.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a critical graphics abstraction layer within Chrome. It translates high-level graphics commands from web content into formats the computer's hardware, like the GPU, can understand. Because it bridges the gap between web-based code and hardware, it is a frequent target for security research.

What does this CVE mean in plain English?

This vulnerability is an out-of-bounds read and write (CWE-125). In simpler terms, the code responsible for graphics processing fails to verify data boundaries, allowing it to read or write memory outside its assigned space. This defect can let an attacker escape the browser's sandbox, which is the security wall meant to keep web content separate from your actual computer system.

How does an attacker trigger this vulnerability?

The attack requires a user to navigate to a specifically crafted HTML page designed to exploit the ANGLE component. Simply having Chrome installed does not trigger the bug; the browser must actively render the malicious web content. Standard web pages that do not contain these specific, complex graphics exploits will not trigger the flaw.

Why should I care about CVE-2026-17801?

According to Halo Surface Signal, web browsers are inherently designed to process untrusted content from the internet, making them a common target. Because this CVE involves a sandbox escape, it is highly relevant if you use Chrome to visit public websites, as the browser is constantly exposed to the exact type of external traffic required for an attack.

What is the first step to address this threat?

The most effective first step is to perform an inventory of your environment to identify all systems running Chrome versions older than 151.0.7922.72. Once identified, prioritize these instances based on how they are used and whether they handle sensitive data, then coordinate with your infrastructure team to apply the official browser update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.