CVE-2026-79239: Google Chrome Tint Information Disclosure

CVE-2026-79239 Overview

CVE-2026-79239 is an out-of-bounds read vulnerability in the Tint component of Google Chrome on Android. Tint is the WebGPU Shading Language (WGSL) compiler used by Chrome to translate shader code for the underlying graphics API. Versions of Chrome prior to 152.0.7977.65 on Android are affected. A remote attacker can trigger the flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to read memory inside the renderer sandbox, potentially exposing sensitive process data. The issue is classified under CWE-125: Out-of-bounds Read.

Critical Impact
Remote attackers can read sandboxed renderer memory on Android Chrome via a crafted web page, enabling information disclosure without authentication.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Chromium-based components using the Tint WGSL compiler
Downstream Chromium-derived Android browsers pending upstream patch adoption

Discovery Timeline

2026-08-25 - CVE-2026-79239 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79239

Vulnerability Analysis

The defect resides in Tint, the shader translator that Chrome uses to parse and compile WGSL programs supplied by web content through the WebGPU API. An out-of-bounds read occurs when Tint accesses memory outside the bounds of a buffer while processing attacker-influenced shader input. Because WebGPU exposes Tint directly to untrusted JavaScript, any web page can supply crafted shader source and drive the vulnerable code path.

The attack requires user interaction, which is satisfied by the victim visiting a malicious or compromised page. Exploitation stays within the renderer sandbox, but leaked memory can include pointers, tokens, or shader data useful for chaining with additional vulnerabilities. See the Chromium Issue Tracker entry for upstream tracking.

Root Cause

The root cause is missing or incorrect bounds validation on an index or offset used while reading from an internal Tint data structure. When the compiler processes malformed or edge-case shader constructs, it reads beyond the allocated region and returns the out-of-bounds bytes to attacker-controlled logic. This aligns with CWE-125 semantics for information disclosure via unchecked reads.

Attack Vector

A remote attacker hosts a crafted HTML page that invokes WebGPU and submits a malicious WGSL shader. The victim triggers the flaw by loading the page in Chrome on Android. No credentials or elevated privileges are required. The attacker observes the leaked memory content via WebGPU return values or side-channel behavior in the shader pipeline.

No verified proof-of-concept code is public. Refer to the
[Chromium Issue Tracker #520781436](https://issues.chromium.org/issues/520781436)
for further technical detail once access restrictions are lifted.

Detection Methods for CVE-2026-79239

Indicators of Compromise

Android Chrome clients reporting a version string below 152.0.7977.65 in browser telemetry or user-agent logs.
Outbound HTTPS requests to newly registered domains delivering pages that instantiate WebGPU adapters and submit unusually large or malformed WGSL modules.
Renderer process crash or anomaly reports referencing Tint or the WGSL compiler path.

Detection Strategies

Inventory managed Android endpoints and flag Chrome installations below the fixed build 152.0.7977.65.
Inspect web proxy or DNS logs for pages that combine WebGPU feature detection with heavy shader payloads served to Android user agents.
Correlate browser crash telemetry with visited URLs to surface pages that repeatedly destabilize the renderer.

Monitoring Recommendations

Track Chrome version distribution across the Android fleet and alert on stragglers after the patch window.
Monitor for information disclosure follow-on indicators such as unexpected credential reuse or session anomalies originating from Android browsers.
Ingest browser and mobile device management (MDM) logs into a centralized data lake to enable retrospective hunts for WebGPU abuse patterns.

How to Mitigate CVE-2026-79239

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
Push the update through enterprise MDM policies to enforce automatic upgrades on managed devices.
Advise users to restart Chrome after the update so the patched binary loads.

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Google Chrome Stable Update announcement. Chrome for Android 152.0.7977.65 and later contain the fix. Chromium-derived browsers should pull in the corresponding upstream commit referenced in Chromium Issue #520781436.

Workarounds

Disable WebGPU on Android Chrome by toggling the chrome://flags/#enable-unsafe-webgpu and related WebGPU flags to Disabled until the update is applied.
Restrict browsing on unpatched Android devices to trusted sites via enterprise web filtering.
Where feasible, route Android browsing through a remote browser isolation service to contain renderer-level information disclosure.

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected patched output
# versionName=152.0.7977.65 (or later)