CVE-2026-79142: Google Chrome ANGLE Buffer Overflow Vulnerability

CVE-2026-79142 Overview

CVE-2026-79142 is a heap buffer overflow [CWE-122] in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to load a crafted HTML page. Google's Chromium team rated the security severity as High. The vulnerability requires user interaction, such as visiting a malicious website, but no authentication or elevated privileges.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox on Android devices through a crafted HTML page, breaking a core browser security boundary.

Affected Products

Google Chrome on Android prior to version 152.0.7977.65
Google Android devices running vulnerable Chrome builds
ANGLE graphics translation layer as shipped in affected Chrome versions

Discovery Timeline

2026-08-25 - CVE-2026-79142 published to the National Vulnerability Database
2026-08-27 - Last updated in the NVD database
August 2026 - Google releases Chrome 152.0.7977.65 addressing the issue via the Google Chrome Stable Channel Update

Technical Details for CVE-2026-79142

Vulnerability Analysis

The vulnerability is a heap buffer overflow in ANGLE, the graphics abstraction layer Chrome uses to translate OpenGL ES calls to native graphics APIs. On Android, ANGLE handles WebGL rendering and shader compilation, exposing a network-reachable attack surface through any web page that issues WebGL or GPU-backed drawing commands.

A crafted HTML page can trigger the overflow during graphics processing. Because ANGLE runs with access to GPU resources and interacts with the underlying driver, successful exploitation allows an attacker to execute code outside Chrome's renderer sandbox. This bypasses one of the browser's primary containment boundaries and gives attacker-controlled code direct execution on the Android device.

Root Cause

The root cause is improper bounds checking on a heap-allocated buffer within ANGLE. When the affected code path processes attacker-influenced graphics data, it writes past the end of the allocated region, corrupting adjacent heap metadata or object pointers. See the Chromium Issue Tracker Entry for upstream tracking details.

Attack Vector

Exploitation is network-based and requires the victim to load an attacker-controlled HTML page in a vulnerable Chrome build on Android. The page delivers crafted WebGL or graphics content that reaches the vulnerable ANGLE code path. Because ANGLE historically runs in a GPU or system process with higher privileges than the renderer, corruption in this component enables a sandbox escape and arbitrary code execution outside the standard renderer confinement.

No verified public proof-of-concept code is available for CVE-2026-79142. Refer to the Google Chrome Desktop Update and Chromium issue tracker for authoritative technical context.

Detection Methods for CVE-2026-79142

Indicators of Compromise

Unexpected Chrome or Chrome GPU process crashes on Android devices, particularly with signals consistent with heap corruption
Outbound connections from mobile devices to unfamiliar domains immediately after visiting a suspicious link
Chrome versions on Android reporting a build lower than 152.0.7977.65 in enterprise inventory data

Detection Strategies

Inventory installed Chrome versions across managed Android devices and flag any build below 152.0.7977.65
Monitor mobile threat defense telemetry for anomalous child processes or memory access patterns originating from Chrome
Correlate web proxy logs with known malicious infrastructure delivering WebGL-heavy landing pages to Android user agents

Monitoring Recommendations

Ingest Android endpoint and browser telemetry into a centralized data lake for cross-source correlation and retention
Track Chromium security release cadence and alert when devices remain on vulnerable versions beyond an internal SLA
Watch for crash reports referencing ANGLE, GPU process, or graphics driver modules from user devices

How to Mitigate CVE-2026-79142

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
Enforce mobile device management policies that require current Chrome builds and block outdated versions
Advise users to avoid clicking untrusted links until updates are confirmed across the fleet

Patch Information

Google has fixed CVE-2026-79142 in Chrome 152.0.7977.65 for Android. Details are documented in the Google Chrome Stable Channel Update. Enterprises should validate that Play Store managed distribution is delivering the patched build and confirm installation through MDM compliance reports.

Workarounds

No official workaround replaces patching; prioritize deployment of the fixed Chrome version
Where update rollout is delayed, consider restricting use of Chrome on Android for browsing untrusted sites and route users to a patched alternative browser
Reinforce user awareness on the risk of opening links from unsolicited messages on mobile devices

bash

# Verify Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show versionName=152.0.7977.65 or later