CVE-2026-79149: Google Chrome ANGLE Use After Free Vulnerability

CVE-2026-79149 Overview

CVE-2026-79149 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to visit a crafted HTML page. The Chromium project rated the security severity as High, and the issue is tracked under CWE-416.

Critical Impact
Successful exploitation allows arbitrary code execution outside the renderer sandbox, giving attackers access to the underlying operating system with the privileges of the browser process.

Affected Products

Google Chrome versions prior to 152.0.7977.65 on desktop platforms
Chromium-based browsers embedding the vulnerable ANGLE component
Applications using affected Chromium builds through the Chrome Embedded Framework (CEF)

Discovery Timeline

2026-08-25 - CVE-2026-79149 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79149

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which sits between Chrome's rendering pipeline and the host GPU driver. ANGLE handles WebGL and other GPU-accelerated content, running with elevated trust compared to the renderer sandbox. A use-after-free condition in this component gives attackers a path to memory corruption in the GPU process.

Because the GPU process runs outside the renderer sandbox, exploitation of a memory bug in ANGLE can grant code execution with fewer confinement boundaries than a typical renderer exploit. This matches the CVE description, which explicitly notes code execution outside the sandbox. The scope change reflects that a compromised renderer can pivot into the GPU process across the security boundary.

Root Cause

The defect is a use-after-free ([CWE-416]) in ANGLE. Object lifetime is not correctly synchronized with graphics command execution. Code paths retain and dereference pointers to objects that have been released, allowing attackers to control the contents of freed memory before the stale pointer is used. Details are restricted in Chromium Issue Tracker #536636648 pending broad user updates.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The page hosts WebGL or similar GPU-driven content that manipulates ANGLE object lifetimes to trigger the free-then-use sequence. No authentication is required, and the vulnerability is reachable over the network through routine web browsing. Attackers can deliver the payload through malicious sites, compromised third-party content, or malvertising.

// No public proof-of-concept is available for CVE-2026-79149.
// Technical details are restricted in Chromium Issue Tracker #536636648
// until a majority of users have received the fix.

Detection Methods for CVE-2026-79149

Indicators of Compromise

Unexpected crashes of the Chrome GPU process (chrome.exe --type=gpu-process) preceding suspicious child process activity
Child processes spawned by the Chrome GPU process that are not part of normal browser operations
Outbound network connections from Chrome-related processes to newly registered or low-reputation domains hosting WebGL content
Presence of the vulnerable Chrome build (< 152.0.7977.65) in software inventory

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any version below 152.0.7977.65
Monitor for anomalous process lineage from chrome.exe GPU processes, including shell, script, or LOLBin execution
Correlate browser crash telemetry with subsequent file writes or network activity from the same session
Alert on GPU process memory violations that occur while high-risk WebGL content is being rendered

Monitoring Recommendations

Ingest browser telemetry and endpoint process events into a centralized data lake for cross-source correlation
Track Chrome auto-update health across the fleet to identify hosts stuck on vulnerable versions
Baseline normal GPU process behavior and alert on deviations such as unexpected module loads
Review web proxy logs for user visits to sites serving obfuscated WebGL or heavy graphics payloads shortly before crash events

How to Mitigate CVE-2026-79149

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on user endpoints to ensure the patched binary is loaded into memory
Verify Chromium-based browsers and embedded frameworks have pulled the corresponding upstream fix
Prioritize patching for high-value users such as administrators, developers, and executives

Patch Information

Google addressed CVE-2026-79149 in the Chrome Stable channel release 152.0.7977.65. Details are published in the Google Chrome Stable Update advisory. Enterprises using the Chrome Enterprise MSI or managed update channels should confirm rollout completion and re-image or force-update devices that failed to apply the release.

Workarounds

Disable hardware acceleration in Chrome policy (HardwareAccelerationModeEnabled = false) to reduce ANGLE exposure until patches are applied
Restrict access to untrusted sites through web filtering, especially domains serving unvetted WebGL or 3D content
Enforce site isolation and standard sandbox policies through Chrome Enterprise settings
Use application allowlisting to block child processes from browser GPU processes on sensitive endpoints

bash

# Example Chrome Enterprise policy to disable hardware acceleration on Linux
# /etc/opt/chrome/policies/managed/disable_hw_accel.json
{
  "HardwareAccelerationModeEnabled": false
}