CVE-2026-5275: Google Chrome Buffer Overflow Vulnerability

CVE-2026-5275 Overview

CVE-2026-5275 is a heap buffer overflow vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on macOS. The flaw affects all Chrome versions prior to 146.0.7680.178 and allows remote attackers to execute arbitrary code by serving a crafted HTML page. Google classified the Chromium security severity as High. The weakness is tracked as CWE-122: Heap-based Buffer Overflow.

Critical Impact

A remote attacker can trigger arbitrary code execution in the renderer process by luring a user to a malicious web page, with potential to chain into sandbox escape and full compromise of the host.

Affected Products

• Google Chrome on macOS prior to 146.0.7680.178
• Chromium-based browsers using the ANGLE graphics translation layer
• Downstream distributions inheriting the vulnerable ANGLE component

Discovery Timeline

• 2026-04-01 - CVE-2026-5275 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5275

Vulnerability Analysis

The vulnerability resides in ANGLE, the graphics abstraction layer Chrome uses to translate OpenGL ES API calls into native graphics calls. On macOS, ANGLE bridges WebGL operations to the underlying Metal or OpenGL backend. A heap buffer overflow in this translation path means a web page can issue WebGL or graphics commands that cause Chrome to write beyond the bounds of a heap-allocated buffer in the GPU process.

Successful exploitation corrupts adjacent heap memory and can be leveraged to achieve arbitrary code execution inside the renderer or GPU process. Attackers commonly chain such bugs with a sandbox escape to gain code execution on the host. The vulnerability requires user interaction, satisfied by simply visiting a malicious or compromised site.

Root Cause

The root cause is improper bounds validation when ANGLE handles attacker-controlled graphics state or buffer sizes on the macOS backend. When the size of an input parameter is not properly checked against the destination heap allocation, copying or writing operations overflow the buffer. This class of issue is categorized under CWE-122, heap-based buffer overflow.

Attack Vector

Exploitation is network-based and remote. An attacker hosts a crafted HTML page containing malicious WebGL or canvas content that exercises the vulnerable code path inside ANGLE. When a victim using a vulnerable Chrome build on macOS loads the page, the overflow triggers in the browser process boundary. No authentication is required, only that the user opens the page.

No public proof-of-concept or exploit code has been published. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-5275

Indicators of Compromise

• Chrome GPU or renderer process crashes on macOS hosts with stack traces referencing ANGLE modules.
• Outbound connections from Chrome child processes to unexpected domains immediately after rendering attacker-controlled WebGL content.
• Unexpected child processes spawned by Google Chrome Helper (GPU) or Google Chrome Helper (Renderer).

Detection Strategies

• Inventory installed Chrome versions across managed macOS endpoints and flag any build below 146.0.7680.178.
• Hunt for browser exploitation patterns such as renderer crashes followed by shell or persistence activity within a short time window.
• Correlate web proxy logs with endpoint telemetry to identify users visiting newly registered or low-reputation domains serving heavy WebGL payloads.

Monitoring Recommendations

• Monitor macOS unified logs and crash reports for repeated com.google.Chrome.helper faults indicating exploit attempts.
• Track process lineage to detect any non-browser child process descending from Chrome helper processes.
• Alert on Chrome processes performing file writes outside expected profile directories or executing scripting interpreters.

How to Mitigate CVE-2026-5275

Immediate Actions Required

• Update Google Chrome on all macOS endpoints to 146.0.7680.178 or later through managed software distribution.
• Verify Chromium-based browsers and embedded WebView frameworks have absorbed the upstream ANGLE fix.
• Restart Chrome after patch deployment to ensure the vulnerable processes are no longer running in memory.

Patch Information

Google addressed the vulnerability in the Chrome stable channel update documented in the Google Chrome Update Blog. Administrators should deploy Chrome 146.0.7680.178 or newer on macOS. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

• Disable hardware acceleration in Chrome via chrome://settings to reduce ANGLE code path exposure until patching completes.
• Restrict WebGL through enterprise policy by setting DefaultWebGLEnabled to false for sensitive user groups.
• Block access to untrusted sites at the web proxy or DNS layer to limit exposure to crafted HTML pages.

# Enterprise policy example: disable WebGL via Chrome managed preferences on macOS
sudo defaults write /Library/Preferences/com.google.Chrome DefaultWebGLEnabled -bool false
sudo defaults write /Library/Preferences/com.google.Chrome HardwareAccelerationModeEnabled -bool false