Introduction
Remote attackers could corrupt the heap and execute arbitrary code in Chrome by delivering malicious graphics content to a user's browser. CVE-2025-10502 sits in Chrome's ANGLE graphics engine and affects users on Windows, macOS, and Linux running versions prior to 140.0.7339.185. Google has now patched it, and it is one more memory safety bug in a widely deployed browser component.
Technical Information
CVE-2025-10502 is a heap buffer overflow in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. ANGLE is a cross-platform graphics abstraction layer that translates OpenGL ES API calls to native graphics APIs such as DirectX (on Windows) or Vulkan (on Linux and macOS). It is a core part of Chrome's WebGL and graphics rendering pipeline.
The bug comes from insufficient bounds checking when ANGLE processes certain graphics data. An attacker who sends specially crafted network traffic, such as malicious WebGL shaders or Canvas operations, can trigger a heap buffer overflow in the ANGLE process. The resulting out-of-bounds writes can corrupt heap metadata or adjacent objects and may lead to arbitrary code execution within the browser's process context. The flaw is classified under CWE-122 (Heap-based Buffer Overflow).
As of the publication date, no public code or detailed proof-of-concept information is available. The root cause is improper validation of buffer boundaries in ANGLE's handling of graphics data. Google's Big Sleep AI system discovered the flaw.
Patch Information
Google fixed the overflow in version 140.0.7339.185/.186 for Windows and Mac, and 140.0.7339.185 for Linux. The update adds stricter bounds checking to the ANGLE graphics layer, which blocks the out-of-bounds memory access an exploit would rely on. Users should update Chrome to one of these versions.
Reference: Google Chrome Release Blog
Affected Systems and Versions
- Google Chrome prior to 140.0.7339.185 on Windows
- Google Chrome prior to 140.0.7339.186 on macOS
- Google Chrome prior to 140.0.7339.185 on Linux
Every Chrome configuration that uses ANGLE for graphics rendering is affected if it runs a vulnerable version.
Vendor Security History
Chrome has had several high-severity vulnerabilities in 2025, including multiple zero-days and memory corruption bugs in both the V8 JavaScript engine and ANGLE. Google usually patches quickly, shipping security updates within days to weeks of discovery. The company uses vulnerability discovery tools, including AI systems such as Big Sleep, and runs a mature bug bounty program. Critical vulnerabilities still turn up in Chrome often, because a browser codebase this complex is hard to secure.
