CVE-2026-79215: Google Chrome WebGL RCE Vulnerability

CVE-2026-79215 Overview

CVE-2026-79215 is an integer overflow vulnerability [CWE-190] in the WebGL component of Google Chrome prior to version 152.0.7977.65. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by convincing a user to visit a crafted HTML page. The flaw affects Chrome's rendering pipeline where WebGL calls perform arithmetic on untrusted inputs without adequate bounds checking. Chromium classifies the security severity as Medium, while the CVSS v3.1 score reflects a higher impact due to potential sandbox escape and full compromise of confidentiality, integrity, and availability.

Critical Impact
Successful exploitation enables arbitrary code execution outside the Chrome sandbox on the user's system, giving attackers access to the underlying operating system context.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that consume the affected WebGL code path
Downstream distributions embedding the vulnerable Chromium version

Discovery Timeline

2026-08-25 - CVE-2026-79215 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79215

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, which exposes GPU-accelerated rendering to JavaScript running in the renderer process. An integer overflow occurs when the browser computes sizes or offsets based on attacker-controlled WebGL parameters. When the calculated value wraps around, subsequent memory operations use an undersized buffer or incorrect offset. This mismatch produces out-of-bounds memory access within the GPU or renderer process. An attacker who chains this overflow with additional primitives can achieve arbitrary code execution outside the renderer sandbox.

Root Cause

The root cause is arithmetic on untrusted integer inputs in WebGL without validation against overflow conditions [CWE-190]. WebGL entry points accept size, count, and stride parameters from JavaScript. When these values are multiplied to determine allocation size or buffer offsets, the result can exceed the maximum representable integer and wrap. The subsequent allocation or copy operates on the truncated value while later logic treats the intended larger size as valid.

Attack Vector

Exploitation requires user interaction: the victim must load a malicious or compromised web page in a vulnerable Chrome build. The attacker delivers JavaScript that issues crafted WebGL calls to trigger the overflow. Because WebGL operates against the GPU process boundary, successful exploitation can escape the renderer sandbox and execute code in a higher-privileged process. Delivery vectors include phishing links, malvertising, and compromised sites serving hostile HTML.

No public proof-of-concept code has been verified for this issue. See the Chromium Issue #513760788 and the Google Chrome Stable Update for technical references.

Detection Methods for CVE-2026-79215

Indicators of Compromise

Chrome renderer or GPU process crashes with signatures referencing WebGL functions and integer arithmetic faults
Unexpected child processes spawned by chrome.exe or Google Chrome Helper following visits to untrusted pages
Outbound connections from Chrome processes to unfamiliar command-and-control infrastructure after browsing sessions
Creation of persistence artifacts (scheduled tasks, LaunchAgents, registry Run keys) shortly after Chrome activity

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Correlate browser process crashes with subsequent process creation and network telemetry to surface post-exploitation activity
Hunt for anomalous parent-child relationships where Chrome spawns shells, scripting engines, or LOLBins
Alert on WebGL-heavy pages loaded from newly registered or low-reputation domains in proxy logs

Monitoring Recommendations

Ingest EDR process, file, and network telemetry from browser hosts into a centralized data lake for retrospective hunting
Track Chrome update compliance as an ongoing metric and alert on drift from the fixed version
Monitor GPU process behavior for unexpected memory allocation patterns and crashes
Review DNS and HTTP proxy logs for exfiltration attempts originating from browser processes after suspected exploitation

How to Mitigate CVE-2026-79215

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after applying the update so the patched binaries take effect
Push the update through enterprise management (Chrome Browser Cloud Management, MDM, or configuration management) and verify compliance
Advise users to avoid untrusted links and WebGL-heavy content from unknown sources until patching is confirmed

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix ships in Chrome 152.0.7977.65 and later. Chromium-based browsers should apply the corresponding upstream patch tracked in Chromium Issue #513760788.

Workarounds

Disable hardware acceleration in Chrome settings to reduce the WebGL attack surface where updates cannot be applied immediately
Deploy enterprise policy to restrict WebGL on high-risk user populations until patching completes
Enforce Site Isolation and Enhanced Safe Browsing through Chrome enterprise policies
Use web filtering to block newly registered and low-reputation domains at the proxy or DNS layer

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 152.0.7977.65 or later

# Windows PowerShell version check
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion