CVE-2026-79240: Google Chrome ANGLE RCE Vulnerability

CVE-2026-79240 Overview

CVE-2026-79240 is an out-of-bounds write vulnerability [CWE-787] in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation allows arbitrary code execution inside the Chrome sandbox. Google's Chromium project rates the security severity as High.

Critical Impact
A crafted web page can trigger arbitrary code execution within the Chrome renderer sandbox on Windows, providing a foothold for further sandbox escape attempts and browser-based attack chains.

Affected Products

Google Chrome on Windows prior to version 152.0.7977.65
ANGLE graphics component bundled with affected Chrome builds
Chromium-based browsers on Windows that embed the vulnerable ANGLE version

Discovery Timeline

2026-08-25 - CVE-2026-79240 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79240

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate OpenGL ES calls from WebGL into native Direct3D calls on Windows. An out-of-bounds write occurs when ANGLE processes attacker-influenced graphics state or shader data. Writing past the bounds of an allocated buffer corrupts adjacent memory in the GPU or renderer process.

An attacker exploits the flaw by luring a user to a crafted HTML page that issues specific WebGL or GPU commands. The advisory notes exploitation results in arbitrary code execution inside the sandbox. Code execution within the sandbox typically serves as the first stage of a chain that pairs this bug with a sandbox escape to reach the underlying operating system.

Root Cause

The defect is classified as [CWE-787] Out-of-bounds Write. ANGLE fails to validate a size, index, or offset before writing to a memory buffer while handling graphics operations. Full technical specifics are restricted while affected users update, and the Chromium issue tracker entry remains access-controlled during the disclosure window.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must load an attacker-controlled or compromised web page in a vulnerable Chrome build on Windows. No authentication or prior access is required. The crafted page issues WebGL, WebGPU, or related graphics API calls that steer ANGLE into the vulnerable code path and trigger the out-of-bounds write. See the Chromium Issue Tracker #536532605 for the tracking entry.

Because no verified proof-of-concept has been published, the exploitation pattern is described in prose. Attackers typically host the malicious page on infrastructure delivered through phishing, malvertising, or watering-hole techniques.

Detection Methods for CVE-2026-79240

Indicators of Compromise

Chrome renderer or GPU process crashes with access violation exceptions immediately after visiting an untrusted page
Unexpected child processes spawning from chrome.exe following browser sessions
Outbound connections from Chrome processes to newly registered or low-reputation domains hosting HTML with heavy WebGL content

Detection Strategies

Inventory endpoints running Chrome on Windows and flag any build below 152.0.7977.65 using EDR software inventory or configuration management data.
Alert on abnormal process lineage from Chrome renderer processes, particularly shell, script host, or LOLBin execution following browser activity.
Correlate browser crash telemetry (Windows Error Reporting, WerFault.exe) with visited URLs to surface potential exploitation attempts.

Monitoring Recommendations

Ingest Chrome update status and crash dumps into a central log platform for baseline deviation analysis.
Monitor DNS and web proxy logs for user visits to domains that serve WebGL-heavy content immediately preceding renderer crashes.
Track post-exploitation behaviors such as credential access, persistence, and lateral movement from user workstations that browsed uncategorized sites.

How to Mitigate CVE-2026-79240

Immediate Actions Required

Update Google Chrome on Windows to version 152.0.7977.65 or later across all managed endpoints.
Restart the browser after applying the update to ensure the patched ANGLE binaries are loaded.
Push the update through enterprise management tooling for users who defer restarts.

Patch Information

Google addressed the vulnerability in the Chrome Stable Channel release documented in the Google Chrome Stable Update announcement. Chromium-based browser vendors (Microsoft Edge, Brave, Opera, Vivaldi) that consume ANGLE should ship equivalent fixes; verify each vendor's release notes and update accordingly.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until the patch is deployed.
Disable hardware acceleration in Chrome policy to reduce ANGLE code path exposure, accepting the performance trade-off.
Apply the HardwareAccelerationModeEnabled Chrome enterprise policy set to false as a temporary control on high-risk endpoints.

bash

# Windows Group Policy registry example to disable hardware acceleration
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f

# Verify installed Chrome version on Windows
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion