Google disclosed a critical integer overflow vulnerability in Chrome’s ANGLE graphics layer on Tuesday, warning that attackers could exploit it to execute arbitrary code on Windows and macOS systems. The bug, tracked as CVE-2026-7903, affects all Chrome versions prior to 148.0.7778.96, and Microsoft has confirmed that Edge is also impacted because it shares the same Chromium engine.
What CVE-2026-7903 Is and Why It Matters
At its core, CVE-2026-7903 is an integer overflow in ANGLE, the Almost Native Graphics Layer Engine. This component translates modern graphics API calls—think WebGL—into commands that your computer’s GPU can process. When a website delivers maliciously crafted data, an arithmetic error in this translation layer can corrupt the heap, the memory area where browsers store dynamic data. The result is a potential takeover: a remote attacker could run arbitrary code on your machine just by luring you to a compromised page.
The severity metrics back this up. The vulnerability carries a CVSS 3.1 score of 8.8 (High), with a network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability. User interaction is required—you have to visit the booby-trapped site—but in the browser world, that’s a trivial hurdle.
Google’s fix ships in Chrome version 148.0.7778.96 for desktop. Because the flaw lives in Chromium’s open-source code, Microsoft Edge inherits the same vulnerability, as confirmed by the Microsoft Security Response Center (MSRC) in its advisory. Other Chromium-based browsers—Brave, Opera, Vivaldi, and countless Electron apps—will need to pull in the patch as well.
How Attackers Could Exploit the Flaw
The attack surface is frighteningly ordinary. A crafted HTML page might look like any other website, but behind the scenes it issues a sequence of WebGL calls that trigger an arithmetic overflow in ANGLE’s buffer size calculation. The browser then writes beyond an allocation’s bounds, smashing adjacent memory. From there, an exploit can chain into code execution, often escaping the renderer process sandbox through secondary bugs.
No public exploits or active attacks have been reported as of this writing, but high-severity memory-corruption bugs in browsers have a notorious habit of becoming weaponized within days of disclosure. The Chromium issue tracker for this bug remains restricted—a standard practice to delay providing a roadmap while users update.
Who Needs to Update
If you run Google Chrome on Windows or macOS and your version is older than 148.0.7778.96, you are vulnerable. Microsoft Edge users are in the same boat; Microsoft will release a corresponding update for Edge that incorporates the same Chromium code fix. Even if you don’t use Chrome directly, any application built on Electron (like Slack, Discord, VS Code) or other Chromium-based browsers could be affected, though exposure depends on whether the application’s specific build includes the flawed ANGLE routines.
To check your Chrome version, type chrome://settings/help into the address bar. For Edge, use edge://settings/help. Both pages show the current version and initiate an update check.
Action Plan: For Home Users
Update immediately. Open Chrome’s About page, let it download the latest build, and relaunch the browser. Many users neglect the relaunch step, but until the browser restarts, the new code isn’t loaded, and you remain exposed. Edge users should do the same via its About page.
Be wary of fake update prompts. Real browser updates never appear as pop-ups on random websites or in emails. Always use the browser’s built-in update mechanism.
Disabling WebGL fully is unnecessary for most people and will break many sites. The best defense is simply the patched version. If you run an older operating system that no longer receives browser updates, consider upgrading to a supported OS or switching to a browser that still provides security patches.
Action Plan: For IT Administrators
For managed fleets, assume nothing. Automatic update policies often fail to force a relaunch, leaving endpoints stuck on a vulnerable running process even after the installer fires. Verify not only that the update has been downloaded but that the active browser process reports the fixed version. Tools like group policies, SCCM, Intune, or endpoint management platforms should push Chrome and Edge to version 148.0.7778.96 or later.
Microsoft typically publishes Edge release notes detailing when the upstream Chromium fix is incorporated. Monitor the MSRC advisory and your Edge deployment channels. If you use other Chromium-based browsers or Electron apps, inventory them and check their vendor release notes. Many Electron apps bundle their own Chromium runtime and update on their own schedule.
Employ vulnerability scanners with caution. CPE data for this CVE may be incomplete or overly broad, so validate findings against actual installed version telemetry. A green dashboard that misses a long-running browser process on a seldom-rebooted terminal server is a false sense of security.
Why You Shouldn’t Panic (But Should Still Act Now)
There is no evidence this bug is being actively exploited, which means you have a short but real window to patch without panic. However, the low complexity and high impact make it a prime target for reverse-engineers once the patched code becomes available. The Chromium team typically opens the restricted bug report a few weeks later, which can coincide with exploit publication.
The update also bundles a collection of other security fixes from Chrome’s May 2026 stable release, so applying it closes multiple vectors at once. Treat this as a high-priority patch’n’reboot cycle, not a drop-everything crisis.
The Broader Context: Modern Browser Threats
This isn’t the first time a graphics translation layer has been the Achilles’ heel. Browsers now serve as full-fledged app runtimes, juggling shader code, media codecs, and hardware interaction—all from untrusted web sources. ANGLE’s role is to ensure WebGL and GPU-accelerated CSS work across incompatible graphics drivers, but that abstraction adds attack surface. Memory-unsafe languages like C and C++ remain deeply embedded in these performance-critical components, and integer overflows are a classic failure mode.
The days when browser security focused only on JavaScript sandboxing are long gone. Today’s patches cross a sprawling supply chain: Chromium’s engine, GPU vendor drivers, operating system graphics stacks, and the applications that embed them. That’s why a single integer overflow in a component you’ve probably never heard of can become a must-patch-now emergency.
Outlook
Microsoft will likely release an Edge-specific advisory within days, if not hours, that confirms the fix is available. Administrators should watch for that and for any reports of active exploitation. The Chromium ecosystem will ripple as Opera, Brave, Electron, and other projects spin their updates. For end users, the safest bet is to enable automatic updates on all browsers and to restart them periodically—something many still forget to do. This vulnerability is a reminder that the web’s reach now extends deep into your graphics hardware, and that means the patch cycle is only as strong as the last relaunch.