CVE-2026-79275: Google Chrome ANGLE Use After Free Vulnerability

CVE-2026-79275 Overview

CVE-2026-79275 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native GPU APIs. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a remote attacker to execute arbitrary code outside the Chrome sandbox through a crafted HTML page. Google's Chromium project rates the underlying security severity as High. The vulnerability is classified under CWE-416: Use After Free.

Critical Impact
Successful exploitation grants arbitrary code execution outside the renderer sandbox, giving attackers direct access to the host operating system from a malicious web page.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding vulnerable ANGLE builds
Applications using affected ANGLE components for OpenGL ES translation

Discovery Timeline

2026-08-25 - CVE-2026-79275 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79275

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), which translates WebGL and OpenGL ES API calls into Direct3D, Metal, or Vulkan commands. A use-after-free condition occurs when ANGLE references a GPU resource object after its backing memory has been released. An attacker who controls the freed allocation can steer subsequent virtual method calls or pointer dereferences to attacker-supplied memory.

Because ANGLE runs inside the GPU process rather than the tightly confined renderer, code execution here escapes the standard renderer sandbox. This elevates the impact from a scripted content compromise to full host-level code execution under the browser process privileges. The user interaction requirement is minimal: visiting a crafted page is sufficient.

Root Cause

The root cause is improper lifetime management of a graphics resource inside ANGLE. Object references persist after the underlying allocation is freed, and reuse of that stale reference triggers memory corruption. Attackers groom the heap through WebGL allocations to place controlled data in the freed slot.

Attack Vector

Exploitation is network-based and requires user interaction, typically loading a malicious HTML page containing crafted WebGL calls. The scope is changed because code executes outside the renderer sandbox, affecting resources beyond the vulnerable component. See the Chromium Issue Tracker entry #536659904 and the Google Chrome Stable Update advisory for technical context.

Detection Methods for CVE-2026-79275

Indicators of Compromise

Chrome or Chromium GPU process crashes with signatures pointing to ANGLE modules such as libGLESv2.dll or libANGLE.dylib
Unexpected child processes spawned by chrome.exe following visits to untrusted sites
Outbound network connections initiated by the Chrome GPU process to unfamiliar hosts
WebGL-heavy pages loaded shortly before browser instability or crash reports

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65
Monitor endpoint telemetry for anomalous process creation or memory operations originating from the Chrome GPU process
Correlate browser crash reports with recent URL history to identify potential exploitation attempts
Deploy behavioral rules that alert on Chrome writing executables or loading unsigned modules post-navigation

Monitoring Recommendations

Ingest browser telemetry, EDR process events, and DNS logs into a central data lake for cross-source correlation
Alert on Chrome GPU process exceptions accompanied by outbound connections or file writes
Track patch compliance metrics for Chrome and Chromium-based browsers on a daily cadence

How to Mitigate CVE-2026-79275

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating to ensure the patched ANGLE binaries are loaded into memory
Audit Chromium-derived browsers, such as Edge, Brave, and Opera, and apply their vendor updates once available
Prioritize patching for users with administrative privileges or access to sensitive systems

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for full release notes and download instructions.

Workarounds

Disable hardware acceleration in Chrome settings to reduce ANGLE code paths where feasible
Restrict access to untrusted websites through enterprise web filtering or DNS policy
Enforce Chrome auto-update policies via group policy or MDM to prevent version drift

bash

# Enforce minimum Chrome version via Windows Group Policy registry key
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "TargetVersionPrefix" /t REG_SZ /d "152.0.7977.65" /f

# Disable hardware acceleration as a temporary mitigation
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "HardwareAccelerationModeEnabled" /t REG_DWORD /d 0 /f