CVE-2026-78965 Overview
CVE-2026-78965 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can obtain cross-origin data by serving a crafted HTML page to a victim browser. Google's Chromium project rated the security severity as High. The vulnerability is tracked under [CWE-908: Use of Uninitialized Resource]. Successful exploitation lets an attacker read data across origin boundaries, violating the same-origin policy that isolates web content in the browser.
Critical Impact
Remote attackers can leak cross-origin data from a victim's browser by rendering a crafted HTML page that triggers uninitialized memory reads within ANGLE.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- ANGLE graphics component embedded in Chromium
- Chromium-based browsers that ship the vulnerable ANGLE build
Discovery Timeline
- 2026-08-25 - CVE-2026-78965 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78965
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component that implements WebGL and other GPU-backed features in Chrome. ANGLE translates browser graphics calls into Direct3D, Metal, Vulkan, or OpenGL commands depending on the platform. The issue is classified as [CWE-908], indicating that a resource is used before it has been properly initialized.
When the browser processes graphics operations from a malicious page, ANGLE reads from a buffer, texture, or framebuffer whose contents were not zeroed or overwritten. Residual data from prior operations or from other web origins can therefore be returned to attacker-controlled JavaScript. This breaks the browser's origin isolation model and enables cross-origin data disclosure.
Root Cause
The root cause is missing initialization of GPU-backed resources before they are read by client code. Graphics buffers allocated through ANGLE must be explicitly cleared to prevent leftover contents from becoming observable. Without that clearing step, sampling, readback, or shader operations expose stale memory to JavaScript running in the tab.
Attack Vector
Exploitation is remote and requires only that a victim visit an attacker-controlled or compromised page. The malicious page issues WebGL or Canvas operations that provoke ANGLE into reading the uninitialized resource. Returned pixel or buffer data is then read back into JavaScript through readback APIs and exfiltrated to the attacker. No user interaction beyond page navigation is required. See the Chromium Issue Tracker Entry for the underlying report and the Google Chrome Stable Update for release context. The current EPSS score is 0.402%.
Detection Methods for CVE-2026-78965
Indicators of Compromise
- Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints.
- Outbound web requests to unknown domains immediately after WebGL or Canvas-heavy page loads.
- JavaScript files performing readPixels, getImageData, or texture readback calls followed by data exfiltration to third-party hosts.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65.
- Correlate browser telemetry with proxy logs to spot pages that trigger heavy WebGL activity paired with unusual outbound POST traffic.
- Monitor endpoint detection tooling for anomalous child process or renderer behavior originating from chrome.exe after visiting unknown domains.
Monitoring Recommendations
- Ingest browser and proxy logs into a centralized analytics platform and alert on stale Chrome versions accessing high-risk categories.
- Track Chromium security release announcements and automate compliance reporting for endpoint browser versions.
- Review threat intelligence feeds for URLs weaponizing ANGLE or WebGL flaws and add them to blocklists.
How to Mitigate CVE-2026-78965
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Force-restart Chrome after deployment so the patched binary is loaded into memory.
- Apply matching updates to other Chromium-based browsers once vendors ship the fixed ANGLE build.
Patch Information
Google addressed the issue in the Chrome Stable channel with the release documented in the Google Chrome Stable Update advisory. Administrators should confirm that endpoints have upgraded past 152.0.7977.65 and validate that automatic updates are functioning. Enterprises using Chrome Browser Cloud Management or group policy should push the update through their standard channels.
Workarounds
- Disable hardware acceleration in Chrome to force a software rendering path that avoids the vulnerable ANGLE code where feasible.
- Restrict browsing to trusted sites through URL filtering until the patched version is deployed.
- Use browser isolation or remote browsing solutions for high-risk user groups pending remediation.
# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
