CVE-2026-79120: Google Chrome ANGLE XSS Vulnerability

CVE-2026-79120 Overview

CVE-2026-79120 is a use of uninitialized resource vulnerability [CWE-908] in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can leverage a crafted HTML page to potentially read cross-origin data from the browser process. Chromium engineers rated the security severity as Medium. The issue crosses the same-origin policy boundary through GPU-side memory that was never initialized before being returned to JavaScript-accessible surfaces.

Critical Impact
A remote attacker can host a malicious web page that reads uninitialized memory through ANGLE, potentially leaking cross-origin data such as pixels, textures, or buffer contents rendered by other sites.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable ANGLE component
Desktop channels (Windows, macOS, Linux) covered by the stable channel update

Discovery Timeline

2026-08-25 - CVE-2026-79120 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79120

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which mediates between WebGL calls in the renderer and the platform graphics driver. ANGLE allocates GPU resources such as textures, renderbuffers, and vertex buffers on behalf of web content. In the affected code path, one or more resources are exposed to WebGL consumers before their backing memory is fully initialized. When a script reads back this resource, the returned bytes reflect residual contents from previous allocations rather than a defined value. Because GPU memory is frequently shared across processes and origins, those residual bytes can include image data, framebuffer contents, or intermediate rendering state associated with unrelated origins.

Root Cause

The defect maps to CWE-908: Use of Uninitialized Resource. ANGLE returns a resource handle whose underlying storage was allocated but not zero-filled or otherwise sanitized. The renderer treats the resource as valid and permits sampling, readPixels, or shader access against it, exposing whatever contents were left in memory by prior GPU workloads.

Attack Vector

Exploitation requires the victim to load an attacker-controlled HTML page in a vulnerable Chrome build. The page issues WebGL calls that allocate the affected ANGLE resource type and then reads back the contents using standard WebGL readback primitives. No user interaction beyond page navigation is required, and no privileges are needed on the target system. Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for additional technical context.

Detection Methods for CVE-2026-79120

Indicators of Compromise

Chrome browser processes running versions earlier than 152.0.7977.65 on managed endpoints.
Web traffic to unfamiliar domains that immediately request WebGL contexts and issue repeated readPixels or texture readback calls.
Renderer processes exhibiting elevated GPU memory allocation churn tied to a single tab.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65.
Correlate browser telemetry with proxy or DNS logs to identify sessions loading pages that instantiate WebGL contexts from low-reputation domains.
Monitor Chrome crash and GPU process logs for anomalous ANGLE errors that could indicate probing.

Monitoring Recommendations

Ingest endpoint browser version data into your central logging platform and alert on outdated Chrome installs.
Track outbound requests to newly registered domains that serve WebGL-heavy content.
Review GPU process telemetry for repeated allocation patterns that align with automated readback loops.

How to Mitigate CVE-2026-79120

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints.
Restart browsers after deployment to ensure the patched binaries are loaded.
Push the update to Chromium-based browsers that embed ANGLE as they publish downstream fixes.

Patch Information

Google addressed the issue in the stable channel update announced at the Google Chrome Stable Update. Administrators managing Chrome through enterprise policy should confirm the 152.0.7977.65 build is deployed. Details tracking the fix are available in the Chromium Issue Tracker Entry.

Workarounds

Disable WebGL via enterprise policy where business use cases permit, using the WebGLEnabled policy set to false.
Restrict browsing to trusted domains through URL allowlists until patching is complete.
Isolate high-risk browsing in a hardened profile or virtualized environment to limit exposure to cross-origin data.

bash

# Configuration example: enforce minimum Chrome version and disable WebGL via policy
# Windows registry (HKLM) example for Chrome enterprise policy
reg add "HKLM\Software\Policies\Google\Chrome" /v WebGLEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f