CVE-2026-79118: Google Chrome ANGLE Information Disclosure

CVE-2026-79118 Overview

CVE-2026-79118 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the vulnerability through a crafted HTML page to obtain cross-origin data. Chromium classifies the security severity as High. The vulnerability is tracked under CWE-908: Use of Uninitialized Resource.

Critical Impact
Remote attackers can leak cross-origin data by serving a malicious HTML page, undermining the same-origin policy that isolates sensitive web content.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable ANGLE component
Applications and frameworks that bundle affected Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79118 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79118

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which Chrome uses to implement WebGL and other GPU-backed web APIs. ANGLE fails to fully initialize a graphics resource before that resource is exposed to JavaScript running in the renderer. As a result, memory or GPU buffer contents from unrelated origins or processes can be read back through legitimate WebGL calls. An attacker who serves a crafted HTML page can trigger the code path that returns the uninitialized resource. The leaked bytes can include pixel data, texture content, or other GPU-resident information tied to cross-origin resources. This class of flaw breaks the same-origin policy that browsers rely on to isolate untrusted content from sensitive data.

Root Cause

The root cause is an initialization gap in ANGLE, categorized as CWE-908: Use of Uninitialized Resource. A GPU resource is allocated and made accessible before its backing memory is zeroed or overwritten with defined content. When JavaScript reads the resource through WebGL APIs, it receives whatever data previously occupied the underlying buffer.

Attack Vector

Exploitation is remote and requires only that the victim load an attacker-controlled HTML page in a vulnerable Chrome build. No authentication is required, and no additional user interaction beyond visiting the page is needed. The attacker's page issues WebGL calls that allocate and sample the uninitialized resource, then reads the returned pixels back into JavaScript for exfiltration. Because the leaked data may originate from other origins, the vulnerability defeats browser isolation guarantees. The vulnerability mechanism is described in the Chromium tracking issue and the Chrome Stable Channel update.

Detection Methods for CVE-2026-79118

Indicators of Compromise

Chrome browser processes reporting a version string below 152.0.7977.65 in enterprise inventory or telemetry data.
Renderer processes making sustained WebGL readPixels calls immediately after resource allocation on untrusted pages.
Outbound HTTP or WebSocket traffic carrying base64-encoded pixel buffers to attacker-controlled domains.

Detection Strategies

Inventory endpoints for installed Chrome and Chromium-based browser versions and flag any build below 152.0.7977.65.
Monitor web proxy logs for repeat visits to newly registered or low-reputation domains that serve WebGL-heavy HTML content.
Correlate browser crash reports and GPU process anomalies with subsequent outbound data transfers from the same session.

Monitoring Recommendations

Enforce browser version reporting through management tooling such as Chrome Browser Cloud Management or MDM policies.
Track EPSS scoring for CVE-2026-79118, currently 0.244% (percentile 15.372), for changes that may indicate emerging exploitation.
Review DLP telemetry for anomalous canvas or WebGL image exports leaving the corporate perimeter.

How to Mitigate CVE-2026-79118

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints without delay.
Restart browser sessions after patch deployment to ensure the vulnerable renderer and GPU processes terminate.
Audit Chromium-based applications, including Electron builds and embedded WebViews, and upgrade to versions incorporating the fixed ANGLE component.

Patch Information

Google addressed CVE-2026-79118 in the Chrome Stable Channel update that ships 152.0.7977.65. Deployment details are available in the Chrome Stable Channel update announcement, with the upstream fix tracked in Chromium Issue #535379043.

Workarounds

Disable hardware acceleration in Chrome using the HardwareAccelerationModeEnabled policy to reduce reliance on ANGLE code paths until patching completes.
Restrict browsing on unpatched endpoints to trusted internal sites through enterprise proxy allow-lists.
Block or sandbox WebGL for high-risk user groups via browser policies and endpoint isolation controls.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy example: disable hardware acceleration until patched (Linux JSON policy)
cat <<'EOF' > /etc/opt/chrome/policies/managed/disable_hwaccel.json
{
  "HardwareAccelerationModeEnabled": false
}
EOF