CVE-2026-79230: Google Chrome ANGLE RCE Vulnerability

CVE-2026-79230 Overview

CVE-2026-79230 is an improper input validation vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to platform-specific graphics APIs. The flaw affects Google Chrome on macOS prior to version 152.0.7977.65. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page to a target user. The vulnerability is tracked under [CWE-20] (Improper Input Validation). Chromium security engineers rated the underlying issue medium, though NVD assigns a higher score reflecting the sandbox escape potential.

Critical Impact
Successful exploitation permits code execution outside the Chrome renderer sandbox on macOS, giving attackers native access to the user's session through a single crafted web page.

Affected Products

Google Chrome for macOS versions prior to 152.0.7977.65
Chromium-based browsers on macOS that ship the vulnerable ANGLE component
Applications embedding the affected Chromium build on macOS

Discovery Timeline

2026-08-25 - CVE-2026-79230 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79230

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates WebGL and OpenGL ES calls from Chrome into native graphics API calls. On macOS, ANGLE typically targets Metal and OpenGL backends. The vulnerability arises from insufficient validation of input passed into ANGLE from the renderer process.

An attacker hosts a crafted HTML page containing malicious WebGL content. When a victim visits the page, the page issues shader or draw calls with malformed parameters. ANGLE fails to validate these inputs before passing them to the GPU process, enabling memory corruption or unsafe operations in a higher-privileged process.

Because ANGLE runs in the GPU process rather than the sandboxed renderer, successful exploitation escapes the renderer sandbox. This grants the attacker the privileges of the GPU process, which are broader than a renderer's on macOS.

Root Cause

The root cause is missing or incorrect input validation in ANGLE's handling of graphics API parameters, classified as [CWE-20]. Untrusted data supplied through the WebGL interface reaches sensitive code paths without adequate bounds or type checks.

Attack Vector

Exploitation requires no privileges but does require user interaction: the victim must load a malicious page in Chrome on macOS. The attack is network-reachable, low-complexity, and impacts confidentiality, integrity, and availability. See the Chromium Issue Tracker #520504922 and the Chrome Stable Channel Update for vendor context.

No verified public proof-of-concept code is available. The vulnerability mechanism involves malformed WebGL inputs reaching ANGLE without proper validation; refer to the Chromium advisory for the technical write-up.

Detection Methods for CVE-2026-79230

Indicators of Compromise

Chrome GPU process (Google Chrome Helper (GPU)) crashes or unexpected child process spawning on macOS hosts
Outbound connections from Chrome helper processes to previously unseen domains following browser use
Unusual file writes to user directories by Chrome GPU helper processes

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 152.0.7977.65
Monitor for anomalous child processes launched by Chrome helper processes, which is atypical under normal sandboxing
Correlate WebGL-heavy page loads with GPU process crashes recorded in Chrome crash telemetry

Monitoring Recommendations

Enable endpoint telemetry that captures process lineage for Chrome and its helper processes on macOS
Ingest browser and OS logs into a central data lake to search for post-exploitation behaviors such as shell spawning from GPU processes
Alert on Chrome helper processes performing network activity to domains not associated with Google update infrastructure

How to Mitigate CVE-2026-79230

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 152.0.7977.65 or later
Restart Chrome after update to ensure the patched GPU process binary is loaded
Audit Chromium-based browsers and Electron applications on macOS for the vulnerable ANGLE component and update accordingly

Patch Information

Google released the fix in the Chrome Stable channel at version 152.0.7977.65 for macOS. Details are published in the Chrome Stable Channel Update. Enterprise administrators should push the update via Chrome Browser Cloud Management or existing MDM tooling.

Workarounds

Disable hardware acceleration in Chrome via chrome://settings to reduce ANGLE code path exposure, understanding this degrades performance
Restrict WebGL through enterprise policy where feasible until the patch is deployed
Apply strict web filtering to limit user exposure to untrusted HTML content during the patch window

bash

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update via MDM (Jamf example)
sudo jamf policy -event update-chrome