REDHAT-BUG-2524088: Buffer Overflow

Q: Which deployments are affected?

Google Chrome for Android versions prior to 152.0.7977.65 are affected. The issue is in ANGLE.

Q: What does an attacker need to exploit this issue?

An attacker can exploit the vulnerability remotely by causing a user to process a crafted HTML page. Successful exploitation can result in arbitrary code execution outside the browser sandbox.

Q: Is the issue limited to sandboxed code execution?

No. The vulnerability is described as allowing arbitrary code execution outside the sandbox, increasing the impact beyond code execution confined to Chrome's normal sandbox.

Published Aug 25, 2026

Updated

Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome for Android<152.0.7977.65

Event History

Aug 25, 2026

Data Sourced

via Red Hat·09:10 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Google Chrome for Android versions prior to 152.0.7977.65 are affected. The issue is in ANGLE.

What does an attacker need to exploit this issue?

An attacker can exploit the vulnerability remotely by causing a user to process a crafted HTML page. Successful exploitation can result in arbitrary code execution outside the browser sandbox.

Is the issue limited to sandboxed code execution?

No. The vulnerability is described as allowing arbitrary code execution outside the sandbox, increasing the impact beyond code execution confined to Chrome's normal sandbox.

REDHAT-BUG-2524088: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is the issue limited to sandboxed code execution?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is the issue limited to sandboxed code execution?