CVE-2026-79130 Overview
CVE-2026-79130 is a heap buffer overflow [CWE-122] in the ANGLE graphics abstraction layer of Google Chrome. ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls to native graphics APIs such as Direct3D, Metal, and Vulkan. A remote attacker can exploit the flaw by serving a crafted HTML page that triggers memory corruption during graphics processing. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google patched the issue in Chrome 152.0.7977.65 on the stable desktop channel.
Critical Impact
Sandbox escape leading to arbitrary code execution on the host system when a user visits an attacker-controlled web page.
Affected Products
- Google Chrome for Desktop prior to 152.0.7977.65
- Chromium-based browsers embedding vulnerable ANGLE builds
- Applications relying on Chromium Embedded Framework (CEF) with affected ANGLE versions
Discovery Timeline
- 2026-08-25 - CVE-2026-79130 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79130
Vulnerability Analysis
The vulnerability resides in ANGLE, the component that Chrome uses to implement WebGL and other GPU-accelerated features. A heap buffer overflow occurs when ANGLE processes attacker-controlled graphics state or shader input from a crafted HTML page. The overflow corrupts adjacent heap memory in the GPU process. Because the flaw enables code execution outside the Chrome sandbox, the impact scope changes from the renderer to the host operating system. User interaction is required: the victim must load or be redirected to the malicious page. Chromium security rated the issue as High severity in its internal tracker.
Root Cause
The root cause is improper bounds validation on heap-allocated buffers within ANGLE's translation of GL calls. When the crafted input drives an allocation size or index calculation that exceeds the destination buffer, ANGLE writes past the allocation boundary. This condition maps to [CWE-122] Heap-based Buffer Overflow.
Attack Vector
Exploitation is network-based and requires no privileges. An attacker hosts a malicious page containing WebGL or GPU-related content that reaches the vulnerable ANGLE path. When the victim visits the page, the overflow triggers in the GPU process. Because the GPU process runs with broader host privileges than a renderer, successful exploitation bypasses the renderer sandbox. Public exploit code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is publicly available. Technical details are tracked in Chromium Issue Tracker #523717796.
Detection Methods for CVE-2026-79130
Indicators of Compromise
- Unexpected child processes spawned from chrome.exe or the Chrome GPU process, particularly shells or scripting engines.
- Crash reports referencing libGLESv2, libANGLE, or GPU process termination on visiting specific URLs.
- Outbound connections from Chrome-launched processes to unfamiliar infrastructure shortly after browsing activity.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build earlier than 152.0.7977.65.
- Monitor process lineage where the Chrome GPU process is the parent of non-browser executables.
- Correlate browser telemetry with proxy or DNS logs to identify users visiting suspected exploit-hosting domains.
Monitoring Recommendations
- Enable browser crash telemetry forwarding to a central log store for retrospective analysis.
- Alert on Chrome writing executables to user-writable directories such as %APPDATA% or /tmp outside expected update paths.
- Track EDR events for code injection or memory-write anomalies originating from Chrome processes.
How to Mitigate CVE-2026-79130
Immediate Actions Required
- Update Google Chrome to 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints.
- Restart the browser after updating to ensure the patched binaries load into memory.
- Update Chromium-based browsers and embedded Chromium runtimes to versions that ship the fixed ANGLE component.
Patch Information
Google released the fix in the stable channel update for desktop covering Chrome 152.0.7977.65. Deployment details are available in the Google Chrome Desktop Update advisory. Enterprises using managed browser policies should confirm auto-update is not blocked and force an update where necessary.
Workarounds
- Disable hardware acceleration in Chrome settings to reduce ANGLE code paths reachable through WebGL until patching is complete.
- Restrict access to untrusted websites via web filtering or a browser isolation solution during the patch window.
- Enforce site isolation and the Chrome Enterprise policy that requires the latest stable channel to prevent version drift.
# Verify Chrome version on Linux/macOS
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Temporarily disable hardware acceleration via managed policy (Windows)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
