CVE-2026-79127: Google Chrome ANGLE RCE Vulnerability

CVE-2026-79127 Overview

CVE-2026-79127 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the issue by serving a crafted HTML page to a target user. Successful exploitation allows arbitrary code execution outside the browser sandbox. The vulnerability is tracked under CWE-787 and referenced in Chromium Issue Tracker #517045394.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox by luring a user to visit a malicious webpage, bypassing a core browser security boundary.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers sharing the ANGLE component
Desktop Chrome installations across Windows, macOS, and Linux

Discovery Timeline

2026-08-25 - CVE-2026-79127 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79127

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which mediates WebGL and graphics API calls between the renderer and the underlying GPU driver. An out-of-bounds write occurs when ANGLE processes attacker-controlled graphics state or buffer data supplied through a crafted HTML page.

Because ANGLE runs in the GPU process rather than the sandboxed renderer, memory corruption in this component can grant execution privileges outside the renderer sandbox. This elevates the impact beyond typical renderer bugs, giving attackers a path toward the host operating system.

The attack requires user interaction, specifically loading a malicious page. No authentication is required, and the attack vector is network-based. See the Chrome Blog Update for the vendor advisory.

Root Cause

The root cause is an out-of-bounds write [CWE-787] within ANGLE. Insufficient bounds validation on graphics buffers or state parameters allows writes past the intended memory region. Corrupting adjacent structures inside the GPU process enables control-flow hijacking or memory manipulation that leads to arbitrary code execution.

Attack Vector

An attacker hosts or injects a crafted HTML page containing malicious WebGL or graphics workloads. When a Chrome user visits the page, the browser passes the payload to ANGLE for processing. The malformed input triggers the out-of-bounds write, corrupts GPU process memory, and enables code execution outside the sandbox.

The vulnerability can be chained with drive-by download or malvertising campaigns to reach a wide user base. Public proof-of-concept code is not available at the time of publication.

No verified exploit code is publicly available. See the Chromium Issue Tracker #517045394 for technical details when access restrictions are lifted.

Detection Methods for CVE-2026-79127

Indicators of Compromise

Chrome GPU process crashes or unexpected terminations correlated with browsing activity
Outbound network connections initiated by chrome.exe or child GPU processes to unfamiliar hosts following a page load
Creation of new persistence entries or child processes spawned from the Chrome GPU process
Deployment of Chrome binaries with versions earlier than 152.0.7977.65 across the fleet

Detection Strategies

Inventory installed Chrome versions and flag hosts running builds prior to 152.0.7977.65
Monitor process trees for anomalous children of the Chrome GPU process, which normally does not spawn interactive utilities
Alert on WebGL-heavy pages served from low-reputation domains combined with GPU process crash telemetry
Correlate browser crash dumps with subsequent suspicious process or network behavior on the same host

Monitoring Recommendations

Ingest Chrome update telemetry and endpoint browser inventory into the SIEM for continuous version tracking
Track EDR telemetry for memory-access violations inside chrome.exe GPU worker processes
Log DNS and HTTP telemetry to identify visits to newly registered domains that deliver WebGL payloads
Enable browser crash reporting and forward reports to a central location for triage

How to Mitigate CVE-2026-79127

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart Chrome after deploying the update so the patched binary is loaded
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their corresponding upstream patches
Restrict execution of unmanaged or portable Chrome installations that bypass enterprise update policies

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Chrome Blog Update. Upgrade to Chrome 152.0.7977.65 or newer. Enterprise administrators should validate that automatic updates are enabled through the ChromeUpdate policy or equivalent management tooling.

Workarounds

Disable hardware acceleration in Chrome settings to reduce ANGLE code path exposure until patching is complete
Enforce Safe Browsing Enhanced Protection through group policy to block known malicious pages
Restrict access to untrusted websites using web filtering or DNS policy for high-risk users
Deploy site isolation and strict SameSite cookie policies to limit blast radius of a compromised renderer or GPU process

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on Linux
google-chrome --version

# Disable hardware acceleration as a temporary workaround (Linux launch flag)
google-chrome --disable-gpu