CVE-2026-78978 Overview
CVE-2026-78978 is an out-of-bounds read vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65 and can be triggered when a user visits a crafted HTML page. A remote attacker who successfully exploits the issue can potentially execute arbitrary code outside the Chrome sandbox, expanding impact beyond the renderer process. The vulnerability is tracked under [CWE-125] Out-of-Bounds Read and is documented in the Google Chrome Desktop Update advisory and Chromium Issue Tracker #520464738.
Critical Impact
A remote attacker can trigger memory disclosure and potentially execute arbitrary code outside the Chrome sandbox on Windows through a single crafted web page.
Affected Products
- Google Chrome for Windows versions prior to 152.0.7977.65
- Microsoft Windows (host operating system for the affected browser)
- Chromium-based components leveraging the ANGLE graphics translation layer
Discovery Timeline
- 2026-08-25 - CVE-2026-78978 published to the National Vulnerability Database
- 2026-08-27 - Last updated in the NVD database
Technical Details for CVE-2026-78978
Vulnerability Analysis
The vulnerability resides in ANGLE, the graphics abstraction layer Chrome uses to translate OpenGL ES calls into native Direct3D, Vulkan, or Metal calls. On Windows, ANGLE typically bridges WebGL and other GPU-accelerated web APIs to Direct3D. An out-of-bounds read in this layer permits attacker-controlled input from a crafted HTML page to reach a routine that reads memory beyond the intended buffer boundary.
Because ANGLE runs in the GPU process rather than the sandboxed renderer, exploitation can yield code execution outside the renderer sandbox. This elevates impact from a typical renderer disclosure to potential control of a less-restricted process. User interaction is required: the victim must load or navigate to the malicious page.
Root Cause
The underlying defect is classified as [CWE-125] Out-of-Bounds Read. The vulnerable code path fails to correctly validate buffer bounds when processing graphics-related input derived from web content. This allows read access to memory adjacent to the intended allocation, which can leak sensitive data or be chained with additional primitives to influence control flow. Full technical detail remains restricted in the Chromium Issue Tracker #520464738.
Attack Vector
Exploitation is network-based and requires the victim to visit an attacker-controlled or compromised website hosting a malicious HTML page. The page issues graphics API calls, such as WebGL operations, that reach the vulnerable ANGLE code path. No authentication is required. Successful exploitation may enable sandbox escape on Windows hosts, providing the attacker a path toward broader system compromise.
Detection Methods for CVE-2026-78978
Indicators of Compromise
- Chrome GPU process (chrome.exe --type=gpu-process) crashes or unexpected terminations correlated with web browsing sessions.
- Outbound connections from browser child processes to unfamiliar domains immediately after visiting untrusted content.
- Presence of Chrome installations reporting versions earlier than 152.0.7977.65 across managed endpoints.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any host running a build below 152.0.7977.65.
- Monitor Windows Error Reporting and crash telemetry for repeated faults in the Chrome GPU process or ANGLE modules (libGLESv2.dll, libEGL.dll).
- Correlate browser process anomalies with proxy or DNS logs to identify users who accessed the triggering page.
Monitoring Recommendations
- Ingest endpoint browser telemetry and process lineage into a centralized data lake for retrospective hunting once IOCs are published.
- Alert on child process creation from chrome.exe that spawns command shells, rundll32.exe, or unsigned binaries.
- Track patch compliance for Chrome as an ongoing KPI and generate exceptions for hosts that lag more than one release cycle.
How to Mitigate CVE-2026-78978
Immediate Actions Required
- Update Google Chrome on Windows to version 152.0.7977.65 or later on all managed endpoints.
- Restart the browser after updating so the patched ANGLE binaries are loaded into memory.
- Restrict user browsing to trusted sites through web proxy or DNS filtering until patching is confirmed.
Patch Information
Google has released a fixed build in the stable channel. Administrators should deploy Chrome 152.0.7977.65 or newer per the Google Chrome Desktop Update advisory. Enterprise deployments using Chrome Browser Cloud Management or Group Policy should force update checks and validate the resulting version through chrome://settings/help.
Workarounds
- Disable hardware acceleration through the Chrome policy HardwareAccelerationModeEnabled = false to reduce reliance on the ANGLE code path until patching completes.
- Deploy the TargetVersionPrefix policy to pin managed endpoints to the patched Chrome branch.
- Educate users to avoid untrusted links and to close the browser if it becomes unresponsive on unfamiliar pages.
# Configuration example: enforce Chrome update policy on Windows via registry
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
