CVE-2026-79131 Overview
CVE-2026-79131 is an out-of-bounds write vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction component used by Google Chrome. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can trigger arbitrary code execution outside the browser sandbox by convincing a user to load a crafted HTML page. Chromium engineers classified the underlying security severity as High, and the CVSS 3.1 score of 9.6 reflects the sandbox escape impact combined with the required user interaction.
Critical Impact
Sandbox escape leading to arbitrary code execution on the host system through a single crafted web page.
Affected Products
- Google Chrome (Desktop) versions prior to 152.0.7977.65
- Chromium-based browsers embedding the vulnerable ANGLE component
- Any application shipping the affected libANGLE build for graphics translation
Discovery Timeline
- 2026-08-25 - CVE-2026-79131 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79131
Vulnerability Analysis
The issue is an out-of-bounds write ([CWE-787]) inside ANGLE, the library Chrome uses to translate OpenGL ES calls into native graphics APIs such as Direct3D, Metal, or Vulkan. ANGLE runs inside the GPU process, which historically holds a broader capability set than the renderer sandbox. Writing past an allocated buffer inside ANGLE lets an attacker corrupt adjacent memory in the GPU process. Because the scope changes across a trust boundary, successful exploitation escapes the renderer sandbox and reaches host-level execution.
Root Cause
Out-of-bounds writes in ANGLE typically arise when shader compilation, texture handling, or draw-call state management fails to validate size or index arguments before writing to a fixed-size buffer. The vulnerable code path accepts attacker-controllable geometry from WebGL or WebGPU content in an HTML page. Missing bounds enforcement allows a write beyond the intended object, corrupting neighboring heap structures used later for control-flow decisions.
Attack Vector
Exploitation requires a victim to open or be redirected to a malicious page. The page issues crafted WebGL or WebGPU commands that reach the vulnerable ANGLE path in the GPU process. The attacker shapes the memory layout, triggers the out-of-bounds write, and pivots to arbitrary code execution outside the sandbox. No credentials are required, and the attack is delivered over the network. Refer to the Chromium Issue Tracker Entry and the Chrome Desktop Update Blog Post for vendor context.
Detection Methods for CVE-2026-79131
Indicators of Compromise
- Chrome GPU process (chrome.exe --type=gpu-process) crashes or unexpected restarts correlated with browsing activity
- Child processes spawned by the Chrome GPU process that are not part of the standard Chromium process tree
- Outbound connections from Chrome-hosted processes to newly registered or low-reputation domains immediately after page loads
- Presence of Chrome installations reporting versions earlier than 152.0.7977.65 in asset inventory
Detection Strategies
- Inventory browser versions across managed endpoints and flag any Chrome build below 152.0.7977.65.
- Monitor for anomalous process lineage where the Chrome GPU process launches shells, script interpreters, or LOLBins.
- Correlate GPU process crash telemetry with subsequent persistence or credential-access behavior on the same host.
Monitoring Recommendations
- Ingest browser telemetry, EDR process events, and GPU driver logs into a central data lake for cross-source correlation.
- Alert on WebGL or WebGPU-heavy page loads followed by unexpected memory-region changes or module loads in Chrome.
- Track egress traffic from browser processes to detect post-exploitation staging or command-and-control activity.
How to Mitigate CVE-2026-79131
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Force-restart Chrome after deployment; the patch only takes effect on relaunch.
- Apply equivalent updates to Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi as vendors release them.
- Reduce user exposure to untrusted sites during the patch rollout using URL filtering or isolation.
Patch Information
Google addressed the issue in the Stable channel release documented in the Chrome Desktop Update Blog Post. The fixed version is 152.0.7977.65. Enterprises using Chrome Browser Cloud Management or group policy should confirm the update reaches all endpoints and that automatic updates remain enabled.
Workarounds
- Disable hardware acceleration in Chrome (chrome://settings/system) to reduce ANGLE code path exposure until patching completes.
- Restrict WebGL and WebGPU on untrusted origins through enterprise policy where feasible.
- Enforce site isolation and Enhanced Safe Browsing to raise the cost of exploitation attempts.
# Configuration example: enforce minimum Chrome version and disable hardware acceleration via policy (Windows)
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
