Loading vulnerability…
Potential sandbox escape in Google Chrome ANGLE
CVE-2026-17655 is an insufficient input validation vulnerability in ANGLE, the graphics translation layer used by Google Chrome. It affects Chrome versions before 151.0.7922.72. A remote attacker could potentially escape the browser sandbox through a crafted HTML page. The specific vulnerable function and underlying exploitation mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could potentially bypass the browser sandbox's isolation boundary. Specific resulting capabilities, such as arbitrary code execution or access to sensitive data, are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict access to untrusted web content using URL and DNS filtering, run browser users without administrative privileges, and enable available exploit protection. These measures reduce exposure or potential consequences but do not correct the input validation flaw.
Patch, then assume compromise.
Upgrade Google Chrome to version 151.0.7922.72 or later. For Debian Chromium installations, apply the distribution's security update: version 151.0.7922.71-1~deb13u1 for Debian trixie, or 151.0.7922.71-1~deb12u1 or later for the corresponding Debian 12 packages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.