CVE-2026-79048 Overview
CVE-2026-79048 is an out-of-bounds write vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can potentially execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a target user. Google classifies the Chromium security severity as High. The weakness is tracked under CWE-787 and requires user interaction, typically visiting a malicious website.
Critical Impact
Successful exploitation allows arbitrary code execution inside the Chrome sandbox on Windows hosts, providing attackers a foothold for sandbox escape chains and further compromise.
Affected Products
- Google Chrome for Windows versions prior to 152.0.7977.65
- Microsoft Windows platforms running vulnerable Chrome builds
- Chromium-based browsers using the affected ANGLE component
Discovery Timeline
- 2026-08-25 - CVE-2026-79048 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79048
Vulnerability Analysis
The vulnerability resides in ANGLE, the graphics abstraction layer Chrome uses to translate OpenGL ES calls into Direct3D on Windows. An out-of-bounds write occurs when the component processes attacker-controlled data from a crafted HTML page. The write past an allocated buffer corrupts adjacent memory in the GPU process. Attackers can leverage this corruption to hijack control flow and execute arbitrary code inside the Chrome sandbox.
Because ANGLE runs inside the GPU process, exploitation grants code execution in a sandboxed context. Attackers typically pair this primitive with a separate sandbox escape to achieve full user-level compromise on the host.
Root Cause
The root cause is improper bounds checking in an ANGLE code path reachable from WebGL or similar rendering APIs. Insufficient validation of size or index parameters allows a write operation to exceed the allocated buffer boundary, corresponding to CWE-787. Full technical details are restricted in the Chromium Issue Tracker #536531630 pending broader patch deployment.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a malicious HTML page containing crafted WebGL or GPU-accelerated content. When a victim visits the page in an unpatched Chrome build on Windows, the ANGLE code path triggers the out-of-bounds write. No authentication is required, and the page can be delivered through phishing, malvertising, or compromised sites.
No verified public code examples are available. Refer to the Google Chrome Stable Update advisory for vendor-confirmed details.
Detection Methods for CVE-2026-79048
Indicators of Compromise
- Unexpected crashes or termination of the Chrome GPU process (chrome.exe --type=gpu-process) shortly after browsing activity
- Outbound connections from Chrome child processes to unfamiliar domains following a WebGL-heavy page load
- Windows Error Reporting entries referencing ANGLE modules such as libGLESv2.dll or libEGL.dll
Detection Strategies
- Inventory Chrome installations across Windows endpoints and flag any build below 152.0.7977.65
- Monitor for suspicious child process creation from chrome.exe, particularly processes spawned by the GPU renderer
- Correlate browser crash telemetry with subsequent process injection or persistence indicators
Monitoring Recommendations
- Enable browser telemetry forwarding to a centralized data lake for behavioral correlation
- Alert on anomalous file writes or registry modifications originating from Chrome sandboxed processes
- Track user visits to newly registered or low-reputation domains hosting heavy WebGL content
How to Mitigate CVE-2026-79048
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all Windows endpoints
- Force-restart Chrome after applying the update so the patched binaries load into memory
- Audit managed browser fleets through enterprise policy tooling to confirm patch adoption
Patch Information
Google addressed CVE-2026-79048 in the Chrome Stable channel release referenced in the Google Chrome Stable Update. Administrators should deploy the update immediately and verify installed versions across the estate. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should also be updated once their vendors ship the equivalent ANGLE fix.
Workarounds
- Disable hardware acceleration in Chrome settings to reduce exposure of the ANGLE code path until patching completes
- Restrict WebGL usage through enterprise policies such as DefaultWebGLSetting where compatible
- Enforce web content filtering to block untrusted sites and reduce exposure to crafted HTML pages
# Enterprise policy example: disable hardware acceleration via Windows registry
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
