CVE-2026-79270: Google Chrome ANGLE Information Disclosure

CVE-2026-79270 Overview

CVE-2026-79270 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to platform-native graphics APIs. The flaw affects Google Chrome versions prior to 152.0.7977.65. A remote attacker can serve a crafted HTML page that triggers ANGLE to operate on uninitialized memory, allowing the attacker to read memory contents outside the sandbox. Google classifies the Chromium security severity as Medium. The weakness maps to [CWE-908: Use of Uninitialized Resource].

Critical Impact
A crafted web page can leak memory contents from outside the Chrome sandbox, exposing sensitive data to a remote attacker with no user interaction beyond visiting the page.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers that ship the vulnerable ANGLE component
Applications embedding pre-patch Chromium/ANGLE builds

Discovery Timeline

2026-08-25 - CVE-2026-79270 published to the National Vulnerability Database
2026-08-26 - Last updated in the NVD database
2026-08-27 - EPSS data recorded for CVE-2026-79270

Technical Details for CVE-2026-79270

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to implement WebGL and related graphics APIs. ANGLE fails to initialize a resource before use, causing subsequent operations to read stale memory contents. A remote attacker who serves a crafted HTML page containing malicious WebGL or graphics API calls can trigger the flaw. The result is disclosure of memory that lies outside the renderer sandbox boundary, which normally isolates web content from sensitive process data. See the Chromium Issue #513048462 tracker for the reference bug.

Root Cause

The root cause is [CWE-908: Use of Uninitialized Resource]. ANGLE allocates or references a graphics resource without first initializing its backing memory or state. When the resource is subsequently read, the returned data reflects whatever bytes previously occupied that memory region. Because ANGLE runs with access broader than the sandboxed renderer, the leaked bytes can include data the web content should not observe.

Attack Vector

Exploitation requires a victim to visit a web page under attacker control. The page issues crafted graphics calls that reach the vulnerable ANGLE path. No authentication is required and interaction is limited to normal browsing. The attacker does not gain code execution from this bug alone. Instead, they read memory outside the sandbox, which can support reconnaissance, defeat address-space layout randomization, or be chained with a separate sandbox-escape primitive.

No public proof-of-concept is available at the time of publication. Technical detail on the specific ANGLE code path is restricted in the Chromium bug tracker.

Detection Methods for CVE-2026-79270

Indicators of Compromise

Browser telemetry showing Chrome versions earlier than 152.0.7977.65 remaining in production use after the August 2026 stable channel update.
Web sessions to unfamiliar domains that host WebGL-heavy pages coinciding with sensitive workflows on the same host.
Renderer process crashes or abnormal GPU-process behavior referencing ANGLE modules.

Detection Strategies

Inventory endpoints for Chrome and Chromium-based browser versions and flag builds below 152.0.7977.65.
Correlate web proxy logs with browser version data to identify vulnerable clients visiting untrusted content.
Monitor endpoint EDR telemetry for anomalous child-process creation or memory access patterns from chrome.exe GPU and renderer processes.

Monitoring Recommendations

Ingest browser update status into the security data lake and alert when hosts fall behind the current stable channel.
Track outbound connections to newly registered domains from browser processes, since exploitation requires the victim to load attacker-controlled content.
Review GPU process crash reports for repeated faults tied to ANGLE, which may indicate exploitation attempts or unstable payloads.

How to Mitigate CVE-2026-79270

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Push the update through enterprise management tooling and confirm rollout status across Windows, macOS, and Linux fleets.
Notify users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) to install vendor updates that incorporate the fixed ANGLE code.

Patch Information

Google addressed the flaw in the Chrome Stable channel update announced on the Chrome Releases blog. The fix ships in Chrome 152.0.7977.65 and later. Downstream Chromium projects should merge the corresponding ANGLE patch and issue their own builds.

Workarounds

Restrict WebGL and hardware-accelerated graphics for high-risk users until patching is complete using enterprise browser policy.
Enforce web filtering to block access to untrusted or newly registered domains that could host crafted HTML payloads.
Isolate browsing of untrusted content using a remote browser isolation service or a dedicated low-privilege browsing profile.

bash

# Chrome enterprise policy example: disable 3D APIs to reduce ANGLE attack surface
# Windows registry (HKLM)
reg add "HKLM\Software\Policies\Google\Chrome" /v Disable3DAPIs /t REG_DWORD /d 1 /f

# macOS plist equivalent
defaults write com.google.Chrome Disable3DAPIs -bool true

# Verify installed Chrome version meets or exceeds 152.0.7977.65
google-chrome --version