CVE-2026-79269: Google Chrome ANGLE Auth Bypass Vulnerability

CVE-2026-79269 Overview

CVE-2026-79269 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. Versions of Google Chrome prior to 152.0.7977.65 are affected. A remote attacker can serve a crafted HTML page to a targeted user and potentially bypass the web origin policy. Chromium security engineers rated this issue at Medium severity. The weakness is classified under CWE-908: Use of Uninitialized Resource.

Critical Impact
A crafted web page can leverage uninitialized graphics resources in ANGLE to read data across origin boundaries, undermining the same-origin policy that isolates untrusted web content.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that embed the affected ANGLE component
Applications embedding the Chromium graphics stack (ANGLE) prior to the fixed version

Discovery Timeline

2026-08-25 - CVE-2026-79269 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79269

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates WebGL and OpenGL ES calls from Chrome into the underlying platform graphics API such as Direct3D, Metal, or Vulkan. The vulnerability arises when ANGLE consumes a resource before that resource has been fully initialized. An attacker who controls the WebGL command stream can influence which uninitialized data the renderer reads, then observe the residual bytes through legitimate readback paths. That residual data may include contents from another origin previously rendered in the same process. The result is a web origin policy bypass reachable from a crafted HTML page. The EPSS model currently rates the probability of near-term exploitation as low, but the attack requires only a victim visiting an attacker-controlled page.

Root Cause

The root cause is CWE-908: Use of Uninitialized Resource inside ANGLE. A graphics resource, likely a texture, buffer, or framebuffer allocation, is bound and sampled without prior clearing. The GPU or ANGLE-managed memory therefore returns stale contents from a prior allocation. Because the browser process reuses graphics memory across origins in the same GPU process, the stale contents can originate from a different site.

Attack Vector

Exploitation requires an attacker to lure a Chrome user to a malicious or compromised web page. The page issues a specifically ordered sequence of WebGL calls that allocate a resource, skip initialization, and then sample or read it back through supported APIs. The attacker then exfiltrates the leaked pixels or buffer contents to a remote server. No authentication or local access is required. See Chromium Issue #520542088 and the Google Chrome Stable Update announcement for vendor details.

No verified exploit code is publicly available for this issue. Refer to the vendor advisory for technical specifics rather than synthetic proof-of-concept code.

Detection Methods for CVE-2026-79269

Indicators of Compromise

Chrome browser processes reporting version strings below 152.0.7977.65 in enterprise inventory data.
Outbound HTTPS POST requests from browser renderer processes to newly registered or low-reputation domains carrying binary or base64 payloads shortly after WebGL activity.
Unusual GPU process crashes or renderer restarts correlated with visits to unfamiliar sites.

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome or Chromium build older than 152.0.7977.65.
Correlate DNS and proxy telemetry with browsing history to identify users who visited untrusted sites hosting WebGL-heavy content before data egress spikes.
Hunt for renderer child processes making direct external network connections outside expected content delivery destinations.

Monitoring Recommendations

Alert on stable-channel Chrome installations that fail to update within the enterprise patch window.
Monitor endpoint EDR telemetry for anomalous child processes of chrome.exe and unexpected GPU sandbox exits.
Track browser extension and WebGL usage patterns on sensitive endpoints such as executive and developer workstations.

How to Mitigate CVE-2026-79269

Immediate Actions Required

Update Google Chrome to 152.0.7977.65 or later on all managed endpoints as documented in the Chrome Stable Channel Update.
Force a browser restart after the update so the patched ANGLE component is loaded into every renderer and GPU process.
Validate patch coverage on Chromium-based derivatives such as Microsoft Edge, Brave, Opera, and Vivaldi once their maintainers publish rebased builds.

Patch Information

Google addressed CVE-2026-79269 in Chrome 152.0.7977.65 on the Stable channel. The fix ships as part of the standard Chrome auto-update mechanism. Administrators using enterprise policies can accelerate rollout by lowering the TargetVersionPrefix gate or by pushing Chrome through their software distribution platform. Track the Chromium tracker entry Issue #520542088 for follow-on fixes.

Workarounds

Disable hardware acceleration in Chrome using the HardwareAccelerationModeEnabled enterprise policy to reduce ANGLE code paths exercised by web content.
Restrict WebGL on high-risk endpoints by setting DefaultWebGLSetting through Chrome enterprise policy where feasible.
Route browsing traffic through a filtering proxy that blocks access to unclassified or newly registered domains until patch deployment completes.

bash

# Configuration example: enforce minimum Chrome version and disable hardware acceleration via policy
# Windows registry keys under HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "152.0.7977.65" /f