CVE-2026-79188: Google Chrome ANGLE RCE Vulnerability

CVE-2026-79188 Overview

CVE-2026-79188 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can exploit this vulnerability by serving a crafted HTML page to a target user. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, which represents a full browser compromise. The vulnerability is tracked as [CWE-787: Out-of-bounds Write].

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox by luring users to a malicious web page, bypassing a primary browser containment boundary.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable ANGLE builds
All platforms shipping the affected Chrome stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-08-25 - CVE-2026-79188 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79188

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan operations on the host system. An out-of-bounds write condition allows attacker-influenced data to be written past the intended buffer boundary. Because ANGLE code paths handle rendering primitives that originate from untrusted web content, the attack surface is directly reachable from any HTML page loaded by the browser.

Google classifies the underlying Chromium severity as High. The reference to sandbox escape indicates that exploitation can affect memory in a process context that leads to breaking out of the renderer sandbox, granting the attacker code execution at the privilege level of the browser process.

Root Cause

The root cause is improper bounds checking within ANGLE when processing graphics state or buffer parameters supplied through web-facing APIs such as WebGL. Insufficient validation of size or index inputs allows a write operation to reach memory outside the allocated region, corrupting adjacent structures. Detailed source-level analysis is restricted while the Chromium Issue Tracker #536444272 remains access-limited.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page containing malicious WebGL or graphics payloads. When a victim visits the page or is redirected through phishing, malvertising, or a compromised site, the browser processes the payload and triggers the out-of-bounds write. Chained with sandbox weaknesses, the primitive enables arbitrary code execution outside the renderer sandbox.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Google Chrome Desktop Update advisory for release-level details.

Detection Methods for CVE-2026-79188

Indicators of Compromise

Chrome renderer or GPU process crashes with access violations referencing ANGLE modules such as libGLESv2.dll or libEGL.dll
Unexpected child process spawns from chrome.exe following browsing sessions to untrusted sites
Outbound network connections from browser processes to previously unseen infrastructure after loading web content

Detection Strategies

Inventory endpoint Chrome versions and flag any installation below 152.0.7977.65
Monitor for anomalous behavior originating from Chrome sandbox helper processes, including unexpected file writes and process injection attempts
Correlate browser crash telemetry with Windows Error Reporting or macOS crash logs pointing to ANGLE stack frames

Monitoring Recommendations

Ingest browser process telemetry into an EDR or SIEM and alert on post-exploitation behaviors such as cmd.exe, powershell.exe, or bash spawned by Chrome
Track DNS and HTTP telemetry for user visits to known malicious domains delivering exploit chains
Enable Chrome Enterprise reporting to centralize crash and security event data for hunting

How to Mitigate CVE-2026-79188

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart browsers after the update to ensure the patched binaries are loaded
Audit Chromium-based browsers and embedded WebViews for downstream builds pending vendor updates

Patch Information

Google addressed CVE-2026-79188 in the Chrome Stable channel release documented in the Chrome Releases advisory. The fix ships in Chrome 152.0.7977.65 and later. Enterprises using Chrome Enterprise should push the update through their standard management tooling. Chromium-derived browsers such as Microsoft Edge, Brave, and Opera should apply their vendor-specific updates once released.

Workarounds

Restrict use of unpatched Chrome installations to trusted internal sites through group policy until updates are deployed
Disable hardware-accelerated graphics through the --disable-gpu flag as a temporary containment measure, understanding that it degrades performance
Deploy web filtering to block access to high-risk categories that commonly host exploit kits

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version