CVE-2026-79043 Overview
CVE-2026-79043 is an out-of-bounds write vulnerability in ANGLE, the graphics translation layer used by Google Chrome to convert OpenGL ES calls to native GPU APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker who serves a crafted HTML page to a victim can trigger memory corruption in the GPU process. Successful exploitation can lead to arbitrary code execution outside the Chrome sandbox. The Chromium project rates the security severity as High, and the NVD assigns a CVSS score of 9.6.
Critical Impact
Remote code execution outside the browser sandbox via a crafted web page, requiring only that the user visit an attacker-controlled site.
Affected Products
- Google Chrome versions prior to 152.0.7977.65 (Desktop, Stable channel)
- Chromium-based browsers that embed the vulnerable ANGLE component
- Applications relying on the affected ANGLE graphics translation layer
Discovery Timeline
- 2026-08-25 - CVE-2026-79043 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79043
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan commands. An out-of-bounds write [CWE-787] occurs when ANGLE processes graphics data supplied through a crafted HTML page.
Because ANGLE runs inside the Chrome GPU process, corrupting memory here provides a strong foothold for a sandbox escape. The GPU process holds capabilities that the more restricted renderer sandbox does not, making it a valuable target for chained exploitation.
The attacker needs no privileges and no local access. User interaction is limited to visiting a malicious or compromised page that delivers WebGL or canvas content designed to trigger the corruption.
Root Cause
The root cause is missing or incorrect bounds validation in ANGLE when writing to a buffer during graphics command processing. Chromium tracks the issue internally as Chromium Issue #532988552. The write past the intended buffer boundary corrupts adjacent memory structures within the GPU process address space.
Attack Vector
Exploitation proceeds through the following stages:
- The victim loads a crafted HTML page containing malicious WebGL, canvas, or shader content.
- The renderer forwards graphics commands to the GPU process, where ANGLE handles translation.
- Attacker-controlled input drives ANGLE to write beyond an allocated buffer.
- The resulting memory corruption is shaped into arbitrary code execution inside the GPU process.
- Code running in the GPU process is used to escape the Chrome sandbox and reach the host operating system.
No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. Refer to the Google Chrome Stable Update advisory for vendor guidance.
Detection Methods for CVE-2026-79043
Indicators of Compromise
- Unexpected crashes or restarts of the Chrome GPU process (chrome.exe --type=gpu-process) shortly after visiting new or untrusted domains.
- Child processes spawned by Chrome that are inconsistent with normal browser behavior, such as command shells or script interpreters.
- Outbound network connections initiated by Chrome to unfamiliar hosts immediately after rendering third-party content.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65.
- Monitor endpoint telemetry for GPU process crashes correlated with WebGL or canvas activity on non-corporate domains.
- Alert on Chrome child processes performing file writes to persistence locations or launching living-off-the-land binaries.
Monitoring Recommendations
- Collect Chrome crash reports and stack traces referencing ANGLE modules such as libGLESv2.dll or libEGL.dll.
- Track browsing telemetry for repeated navigation to pages heavily using WebGL from low-reputation domains.
- Correlate GPU process anomalies with subsequent process creation and network events to identify sandbox escape attempts.
How to Mitigate CVE-2026-79043
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
- Restart Chrome after the update to ensure the patched ANGLE binaries are loaded.
- Push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, or MDM) rather than relying on user-initiated updates.
- Audit third-party Chromium-based browsers and Electron applications for embedded ANGLE versions and apply vendor updates as they ship.
Patch Information
Google released the fix in the Stable channel update documented in the Google Chrome Stable Update advisory. Users on 152.0.7977.65 or later are not affected. Verify the running version at chrome://settings/help and confirm the browser has been relaunched.
Workarounds
- Disable hardware acceleration in Chrome (chrome://settings → System → Uncheck "Use graphics acceleration when available") to reduce reliance on ANGLE code paths until patching completes.
- Enforce site isolation and restrict WebGL on untrusted origins using enterprise policies where feasible.
- Use web filtering and DNS controls to block access to unknown or low-reputation domains that could deliver exploit content.
# Verify Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify Chrome version on Linux
google-chrome --version
# Enterprise policy example (Windows registry) to disable hardware acceleration
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
