CVE-2026-79229 Overview
CVE-2026-79229 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to platform-native graphics APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can read memory outside the sandbox by serving a crafted HTML page. Google classifies the Chromium security severity as Medium. The issue is tracked as [CWE-908: Use of Uninitialized Resource].
Critical Impact
Attackers with renderer process control can exfiltrate memory contents from outside the Chrome sandbox, enabling information disclosure that supports further exploitation chains.
Affected Products
- Google Chrome versions prior to 152.0.7977.65
- Chromium-based browsers embedding the vulnerable ANGLE component
- Desktop platforms served by the Chrome Stable channel
Discovery Timeline
- 2026-08-25 - CVE-2026-79229 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79229
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which Chrome uses to implement WebGL and other graphics APIs. ANGLE fails to initialize a resource before use, exposing residual memory contents to the caller. An attacker who has already achieved code execution in the renderer process can trigger the uninitialized read through a crafted HTML page that issues specific graphics operations.
The practical outcome is out-of-sandbox memory disclosure. The renderer sandbox is designed to contain compromised web content, but the ANGLE code path executes with access to memory regions that the sandbox otherwise restricts. Reading uninitialized memory can reveal pointers, cryptographic material, or session data useful for building a sandbox escape or a full remote code execution chain.
Root Cause
The root cause is a missing initialization step in an ANGLE resource allocation flow, matching the [CWE-908] pattern. When the resource is subsequently read, it returns whatever bytes previously occupied the underlying memory. The Chromium fix is tracked in Chromium Issue #516824665.
Attack Vector
Exploitation is a two-stage operation. The attacker first compromises the renderer process using a separate vulnerability, then loads a crafted HTML page that drives ANGLE into the uninitialized code path. Because the bug requires prior renderer compromise, it functions as a chained information disclosure primitive rather than a standalone initial access vector. The EPSS score is 0.291% at the 21.088 percentile, reflecting the chained exploitation requirement.
No public proof-of-concept code has been released. Refer to the Chrome Stable Channel Update for vendor context.
Detection Methods for CVE-2026-79229
Indicators of Compromise
- Chrome renderer processes making unexpected graphics API calls immediately after loading untrusted content
- Browser telemetry reporting Chrome versions earlier than 152.0.7977.65 in production environments
- Unexplained crashes or memory anomalies in chrome.exe child processes handling WebGL workloads
Detection Strategies
- Inventory browser versions across managed endpoints and flag any Chrome build below 152.0.7977.65
- Monitor endpoint process trees for renderer child processes spawning atypical downstream activity after visiting untrusted origins
- Correlate web proxy logs with endpoint browser telemetry to identify sessions that load pages triggering WebGL-heavy behavior from unknown domains
Monitoring Recommendations
- Enable browser management policies that report installed versions to a central console
- Ingest browser and endpoint telemetry into a centralized data lake to hunt for renderer process anomalies
- Track outbound connections from browser processes that follow suspected exploitation attempts, which may indicate staged secondary payloads
How to Mitigate CVE-2026-79229
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
- Force-relaunch Chrome to ensure users complete the update after the binary is staged
- Audit Chromium-based browsers and embedded WebViews in the environment for equivalent ANGLE updates
Patch Information
Google addressed the issue in the Chrome Stable channel release documented in the Chrome Releases blog. The fix is present in Chrome 152.0.7977.65 and later builds. The corresponding upstream fix is tracked in Chromium Issue #516824665.
Workarounds
- Disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths where operationally acceptable
- Restrict WebGL through enterprise policy for high-risk user groups until patching completes
- Enforce site isolation and block navigation to untrusted origins via web filtering as a compensating control
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS/Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
