CVE-2026-79235: Google Chrome WebGL Use After Free Vulnerability

CVE-2026-79235 Overview

CVE-2026-79235 is a use-after-free vulnerability in the WebGL component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to load a crafted HTML page. The flaw is tracked under CWE-416: Use After Free and carries a Chromium security severity rating of High. Successful exploitation compromises confidentiality, integrity, and availability of the affected system and can break the process isolation boundary that Chrome relies on for containment.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox through a crafted HTML page, resulting in full compromise of the browser process and potential host takeover.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers using vulnerable WebGL code paths
Any downstream distributions embedding pre-patch Chromium releases

Discovery Timeline

2026-08-25 - CVE-2026-79235 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79235

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, which exposes GPU-accelerated 3D graphics APIs to JavaScript running in web pages. A use-after-free condition occurs when the renderer accesses a WebGL object whose backing memory has already been released. An attacker who controls the object lifecycle can reclaim the freed allocation and steer execution through attacker-controlled data.

Because WebGL bridges the sandboxed renderer with GPU process components, exploitation can cross process boundaries. The advisory states that successful exploitation allows code execution outside the Chrome sandbox, which typically requires chaining the renderer bug with logic in the GPU or browser process. See the Chromium Issue Tracker #534468209 for the tracked defect.

Root Cause

The root cause is improper object lifetime management in WebGL, classified as CWE-416. A reference to a WebGL resource persists after the underlying memory has been freed, allowing subsequent operations to read or write the reclaimed region. This dangling reference enables heap manipulation techniques that transform memory corruption into arbitrary code execution.

Attack Vector

Exploitation requires user interaction. A victim must visit a malicious website or open a crafted HTML document rendered by Chrome. No authentication is required, and the attack originates over the network. The crafted page issues a specific sequence of WebGL calls that triggers premature deallocation, then reuses the stale reference to gain control of the renderer process before pivoting outside the sandbox. Refer to the Google Chrome Stable Update advisory for vendor details.

No public proof-of-concept code is available at time of publication. The vulnerability mechanism is described in prose per available references.

Detection Methods for CVE-2026-79235

Indicators of Compromise

Chrome renderer or GPU process crashes with signals consistent with heap corruption when visiting untrusted pages
Unexpected child processes spawned by chrome.exe following browsing sessions
Outbound network connections initiated by Chrome helper processes to previously unseen domains
Creation of persistence artifacts (scheduled tasks, Run keys) immediately after browser activity

Detection Strategies

Inventory Chrome installations across the fleet and flag any build older than 152.0.7977.65
Monitor endpoint telemetry for anomalous process trees originating from Chrome, particularly shell or scripting engines launched by browser processes
Correlate web proxy logs with endpoint alerts to identify users who visited suspicious pages prior to renderer crash events

Monitoring Recommendations

Enable Chrome crash reporting and forward reports to a centralized SIEM for analysis of WebGL-related faults
Alert on unsigned or unexpected binaries written to disk by Chrome helper processes
Track version compliance with automated software inventory to confirm patch propagation

How to Mitigate CVE-2026-79235

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after applying the update so patched binaries are loaded into memory
Push emergency deployment of the patched build to high-risk user groups such as executives and developers
Verify version compliance across Windows, macOS, and Linux fleets after rollout

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases advisory. Chromium-based browser vendors should ship the corresponding upstream fix. Administrators managing Chromium forks should confirm the fix has been merged into their downstream build.

Workarounds

Disable hardware acceleration in Chrome to reduce reliance on the vulnerable WebGL code path until patching completes
Restrict access to untrusted websites through web filtering or browser isolation for unpatched endpoints
Apply enterprise policy to block WebGL where business workflows permit

bash

# Enterprise policy example to disable hardware acceleration on Windows
# HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f

# Verify installed Chrome version on Windows
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion