CVE-2026-79138 Overview
CVE-2026-79138 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. Exploitation requires the victim to load a crafted HTML page. Google's Chromium security team rated the underlying issue as High severity, while the assigned CVSS 3.1 score reflects Critical impact due to sandbox escape potential and scope change. The vulnerability is tracked under CWE-787.
Critical Impact
A remote attacker can trigger an out-of-bounds write in ANGLE via a malicious web page and execute arbitrary code outside the Chrome sandbox on Windows hosts.
Affected Products
- Google Chrome on Windows prior to 152.0.7977.65
- Microsoft Windows hosts running vulnerable Chrome builds
- Chromium-based browsers embedding the same ANGLE component prior to the fixed release
Discovery Timeline
- 2026-08-25 - CVE-2026-79138 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79138
Vulnerability Analysis
ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls issued by Chrome into native Direct3D, Vulkan, or Metal calls. On Windows, ANGLE brokers WebGL and GPU-accelerated content from the renderer process through to the GPU process. An out-of-bounds write in this component writes attacker-controlled data past the bounds of a heap or stack buffer, corrupting adjacent memory.
Because ANGLE runs in the Chrome GPU process, memory corruption there is particularly impactful. The GPU process holds broader privileges than the renderer sandbox, and successful exploitation can enable code execution outside the renderer sandbox on the Windows host. User interaction is required, consistent with drive-by exploitation through a crafted HTML page.
Root Cause
The root cause is an out-of-bounds write [CWE-787] in ANGLE's handling of graphics data. A missing or incorrect bounds check on an index, size, or offset lets a caller write beyond the allocated buffer. Chromium bug #536681676 tracks the specific defect and fix.
Attack Vector
An attacker hosts a crafted HTML page that issues WebGL or graphics API calls designed to trigger the flaw in ANGLE. When a Chrome user on Windows visits the page, the malicious content reaches the GPU process through the normal WebGL pipeline. The out-of-bounds write corrupts adjacent memory in the GPU process, giving the attacker a path to arbitrary code execution outside the renderer sandbox. No credentials are required, and the attack proceeds over the network with a single user click.
No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-79138
Indicators of Compromise
- Unexpected child process creation from chrome.exe GPU process instances, particularly shells or rundll32.exe spawned from the GPU worker.
- Crash reports in Windows Event Log referencing ANGLE modules such as libGLESv2.dll or libEGL.dll on Chrome versions prior to 152.0.7977.65.
- Outbound network connections from Chrome-associated processes to previously unseen domains immediately after a WebGL-heavy page load.
Detection Strategies
- Inventory Chrome versions across the Windows fleet and alert on any endpoint running a build below 152.0.7977.65.
- Hunt for anomalous process lineage where Chrome GPU processes spawn non-browser child processes, which is atypical of normal WebGL workloads.
- Correlate browser crash telemetry with subsequent suspicious process, file, or network activity on the same host within a short window.
Monitoring Recommendations
- Ingest Chrome update telemetry and endpoint version data into a central data lake and alert on stale versions.
- Monitor EDR telemetry for memory-corruption crash signatures inside the Chrome GPU process on Windows.
- Track user navigation to newly registered or low-reputation domains that serve WebGL content in high-risk user populations.
How to Mitigate CVE-2026-79138
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 152.0.7977.65 or later using the vendor's stable channel release.
- Force a browser restart after update deployment so the patched ANGLE binaries are loaded into running Chrome sessions.
- Audit and update Chromium-based browsers and embedded WebViews that ship the vulnerable ANGLE component.
Patch Information
Google addressed the flaw in the Chrome Stable channel release documented in the Google Chrome Stable Update. Administrators should confirm managed Chrome installations report a version of 152.0.7977.65 or higher. The underlying code change is tracked in Chromium Issue #536681676.
Workarounds
- Where patching is delayed, disable hardware acceleration in Chrome via enterprise policy to reduce reliance on ANGLE's GPU code paths, accepting the performance tradeoff.
- Restrict WebGL usage through the DefaultWebGLSetting and related Chrome enterprise policies for high-risk user groups until patching completes.
- Apply web filtering to block access to untrusted or newly registered sites for users who cannot immediately update.
# Configuration example: enforce minimum Chrome version and disable WebGL via Chrome enterprise policy on Windows
# HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebGLSetting /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
