CVE-2026-79019 Overview
CVE-2026-79019 is an out-of-bounds write vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can trigger the issue by serving a crafted HTML page to a user, potentially executing arbitrary code outside the Chrome sandbox. The vulnerability is tracked under [CWE-787] and is rated High severity in Chromium's internal classification.
Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving attackers a path to full compromise of the underlying Windows host from a single visit to a malicious web page.
Affected Products
- Google Chrome on Windows prior to 152.0.7977.65
- ANGLE graphics component shipped with affected Chrome builds
- Microsoft Windows hosts running vulnerable Chrome versions
Discovery Timeline
- 2026-08-25 - CVE-2026-79019 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79019
Vulnerability Analysis
The vulnerability resides in ANGLE, the translation layer that maps OpenGL ES API calls to native graphics APIs such as Direct3D on Windows. ANGLE runs inside Chrome's GPU process, which holds broader privileges than the renderer sandbox. An out-of-bounds write in this component allows an attacker to corrupt adjacent memory during graphics command processing. Because ANGLE handles attacker-influenced data from WebGL and related web APIs, a crafted HTML page can reach the vulnerable code paths remotely. Sandbox escape is possible because code execution occurs inside the GPU process rather than the renderer.
Root Cause
The root cause is classified as [CWE-787] Out-of-Bounds Write. Insufficient boundary validation during graphics buffer or command handling permits writes past the intended memory region. See the Chromium Issue Tracker entry #523266585 for technical details available to authorized researchers.
Attack Vector
Exploitation is network-based and requires user interaction. A victim must load an attacker-controlled or compromised web page that delivers malicious WebGL or ANGLE-reachable content. No authentication is required. Successful exploitation results in memory corruption within Chrome's GPU process on Windows, which the attacker can leverage for arbitrary code execution outside the renderer sandbox.
No public proof-of-concept exploit is available at the time of publication. Refer to the Google Chrome Desktop Update advisory for the vendor's technical summary.
Detection Methods for CVE-2026-79019
Indicators of Compromise
- Unexpected child processes spawned by chrome.exe GPU process (--type=gpu-process), particularly cmd.exe, powershell.exe, or rundll32.exe.
- GPU process crashes correlated with visits to untrusted or newly registered domains hosting WebGL content.
- Outbound network connections originating from the Chrome GPU process to non-Google infrastructure.
Detection Strategies
- Hunt for anomalous process lineage where chrome.exe --type=gpu-process is the parent of shell, scripting, or LOLBin binaries.
- Correlate Chrome version telemetry from managed endpoints against 152.0.7977.65 to identify unpatched hosts.
- Inspect crash telemetry for repeated ANGLE or GPU-process faults, which may indicate exploitation attempts.
Monitoring Recommendations
- Enable browser and endpoint telemetry forwarding to a centralized detection platform for behavioral analysis of Chrome subprocesses.
- Monitor DNS and proxy logs for connections to domains flagged for hosting exploit kits or drive-by download content.
- Track Chrome auto-update status across the fleet and alert on hosts stuck below 152.0.7977.65.
How to Mitigate CVE-2026-79019
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 152.0.7977.65 or later.
- Verify Chrome auto-update is enabled and functioning; force a restart to complete pending updates.
- Restrict browsing to trusted destinations on unpatched hosts until the update is deployed.
Patch Information
Google fixed the vulnerability in Chrome 152.0.7977.65 for Windows. Deployment details are available in the Google Chrome Stable Channel Update for Desktop. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their existing software distribution tooling.
Workarounds
- Disable hardware acceleration in Chrome (chrome://settings → System → "Use hardware acceleration when available") to reduce ANGLE code path exposure until patching is complete.
- Block or restrict WebGL via enterprise policy on high-risk endpoints using the DefaultWebGlSetting or site-level content settings.
- Enforce web filtering and browser isolation to limit exposure to untrusted HTML content while updates roll out.
# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Example Group Policy registry key to disable WebGL fleet-wide
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DefaultWebGlSetting /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
