CVE-2026-79189 Overview
CVE-2026-79189 is an out-of-bounds write vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects all versions of Google Chrome prior to 152.0.7977.65. A remote attacker can exploit the issue by serving a crafted HTML page to a target user. Successful exploitation may allow arbitrary code execution outside the Chrome sandbox, giving the attacker code execution in the context of the browser process or higher-privileged GPU process.
Critical Impact
A crafted web page can trigger memory corruption in ANGLE and lead to arbitrary code execution outside the Chrome sandbox, enabling full compromise of the user session.
Affected Products
- Google Chrome versions prior to 152.0.7977.65 on desktop platforms
- Chromium-based browsers that embed the same ANGLE component and have not integrated the upstream fix
- Applications using vulnerable Chromium/ANGLE builds for embedded web rendering
Discovery Timeline
- 2026-08-25 - CVE-2026-79189 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
- 2026-08 - Google releases stable channel update addressing the flaw (Google Chrome Stable Update)
Technical Details for CVE-2026-79189
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] in ANGLE (Almost Native Graphics Layer Engine). ANGLE translates WebGL and OpenGL ES calls issued by web content into Direct3D, Metal, or Vulkan calls executed by the host GPU driver. When Chrome processes attacker-controlled graphics commands from a malicious HTML page, ANGLE writes data past the bounds of an allocated buffer. The write corrupts adjacent memory in the GPU process, which handles rendering with elevated privileges compared to the renderer sandbox. An attacker who chains this bug with a browser-side primitive can escape the renderer sandbox and execute arbitrary code. The requirement for user interaction (UI:R) means the victim must load or visit a crafted page, but no authentication is required.
Root Cause
The root cause is missing or incorrect bounds validation on data written into an ANGLE-managed buffer during graphics command translation. Attacker-influenced size, index, or offset values reach a write operation without adequate checks. This lets the crafted content place data outside the intended allocation, overwriting object metadata, function pointers, or control structures used by ANGLE and the GPU process.
Attack Vector
Exploitation requires the victim to visit an attacker-controlled or compromised website. The site delivers a crafted HTML page that issues WebGL or related graphics API calls designed to trigger the out-of-bounds write in ANGLE. Because the vulnerable code runs in the GPU process, successful exploitation can bypass the renderer sandbox and reach code execution outside the standard Chrome sandbox boundary. No credentials, prior access, or local presence on the target host are needed.
No public proof-of-concept or exploit code is available at the time of publication. Technical details are tracked in Chromium Issue #536505721, which remains access-restricted per Google's disclosure policy.
Detection Methods for CVE-2026-79189
Indicators of Compromise
- Chrome GPU process (chrome.exe --type=gpu-process) crashing or spawning unexpected child processes after visiting a web page
- Unusual outbound network connections initiated by chrome.exe shortly after rendering unknown third-party sites
- Chrome browser versions below 152.0.7977.65 still present on managed endpoints
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build older than 152.0.7977.65 as vulnerable
- Alert on Chrome GPU process crashes correlated with WerFault.exe or crashpad handler activity, which can indicate memory corruption attempts
- Monitor for child processes or code execution originating from the Chrome GPU or browser process that deviate from normal parent-child chains
Monitoring Recommendations
- Ingest browser process telemetry into a centralized data lake and hunt for anomalous ANGLE or GPU process behavior tied to specific URLs
- Track Chrome auto-update status through management consoles to confirm the patched build is deployed
- Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious sites immediately before a Chrome process crash
How to Mitigate CVE-2026-79189
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all desktop endpoints
- Restart Chrome after the update so the patched binaries are loaded into memory
- Verify Chromium-based browsers and embedded frameworks in use across the environment have integrated the upstream ANGLE fix
Patch Information
Google addressed the issue in the stable channel update to Chrome 152.0.7977.65. Details are published in the Google Chrome Stable Update advisory. The underlying fix is tracked in Chromium Issue #536505721. Administrators should confirm the version through chrome://settings/help or enterprise management tooling.
Workarounds
- Enforce Chrome auto-updates through the ChromeCleanupEnabled and update policies rather than deferring updates
- Restrict browsing to trusted sites via web filtering while patch deployment is in progress
- Consider temporarily disabling hardware-accelerated WebGL through enterprise policy where operationally acceptable
# Verify Chrome version on Windows via command line
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --version
# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
