CVE-2026-79282: Google Chrome ANGLE Use After Free Vulnerability

CVE-2026-79282 Overview

CVE-2026-79282 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can trigger the condition by serving a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox on Android devices. Google classified the underlying Chromium security severity as Critical. The vulnerability is tracked as CWE-416: Use After Free.

Critical Impact
Remote code execution outside the browser sandbox on Android via a single crafted web page, requiring only that the user visit the attacker-controlled site.

Affected Products

Google Chrome for Android versions prior to 152.0.7977.65
ANGLE (Almost Native Graphics Layer Engine) component within Chromium
Chromium-based browsers on Android sharing the vulnerable ANGLE build

Discovery Timeline

2026-08-25 - CVE-2026-79282 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79282

Vulnerability Analysis

The vulnerability resides in ANGLE, the component that translates OpenGL ES API calls into the native graphics API of the host platform. On Android, ANGLE brokers WebGL and GPU operations between the renderer and the underlying graphics stack. A use-after-free condition in this component allows a crafted HTML page to reference GPU-related objects after they have been released. Because ANGLE executes with broader privileges than a standard renderer, corruption of its object lifetime state translates directly into control over code that runs outside the renderer sandbox.

Root Cause

The root cause is improper object lifetime management in ANGLE, categorized as [CWE-416]. An object is freed while a dangling pointer or reference to it remains reachable. Subsequent operations dereference the stale pointer, allowing an attacker who controls the reallocated memory contents to hijack control flow or corrupt privileged state.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must load a crafted HTML page under attacker control, typically through direct navigation, a phishing link, or a malicious advertisement. The page uses WebGL or related graphics APIs to drive ANGLE into the vulnerable state. Because the flaw enables code execution outside the sandbox, the attacker gains capabilities normally denied to renderer processes, including access to files, credentials, and other browser-managed data on the Android device. The vulnerability changes scope, meaning impact extends beyond the exploited component.

See the Chromium Issue Tracker #496807874 and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2026-79282

Indicators of Compromise

Chrome for Android processes crashing with GPU or ANGLE-related stack traces after visiting untrusted pages
Unexpected child processes spawned by Chrome outside typical renderer or GPU process hierarchies
Outbound network connections initiated by Chrome to domains not tied to user browsing activity
Installation or modification of Android APKs or files in Chrome's data directory following web browsing

Detection Strategies

Inventory Chrome versions on managed Android devices and flag any build below 152.0.7977.65
Correlate browser crash telemetry with visits to newly registered or low-reputation domains
Monitor mobile endpoint telemetry for anomalous process behavior originating from the Chrome package

Monitoring Recommendations

Enable mobile threat defense telemetry to capture Chrome process anomalies and post-exploitation activity
Log web proxy and DNS traffic from Android fleets to identify delivery infrastructure for crafted HTML payloads
Track Google Play Store update compliance to confirm affected devices receive the fixed Chrome release

How to Mitigate CVE-2026-79282

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
Enforce automatic Chrome updates via mobile device management for corporate-owned and BYOD Android devices
Restrict access to untrusted websites from Android endpoints handling sensitive data until patching is verified

Patch Information

Google released Chrome 152.0.7977.65 for Android, which contains the fix for this ANGLE use-after-free flaw. Details are available in the Google Chrome Stable Update announcement. Chromium-based browser vendors that consume the ANGLE component should rebase to the patched version and issue equivalent updates.

Workarounds

No official workaround exists; applying the vendor patch is the only complete remediation
Reduce exposure by limiting browsing on unpatched devices to trusted, allowlisted destinations
Consider deploying a mobile browser policy that disables WebGL where business requirements permit

bash

# Verify Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Trigger a Play Store update check for Chrome
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.android.chrome"