CVE-2026-79285 Overview
CVE-2026-79285 is an uninitialized resource vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. Versions of Chrome prior to 152.0.7977.65 allow a remote attacker to obtain cross-origin data through a crafted HTML page. Google Chromium rates the severity as Medium. The flaw is classified under [CWE-908: Use of Uninitialized Resource].
The vulnerability affects the graphics rendering path that translates WebGL and other GPU-accelerated calls to native Windows graphics APIs. Exploitation requires only that a user visit an attacker-controlled or compromised web page.
Critical Impact
A remote attacker can read cross-origin data from other web contexts, breaking the browser's same-origin isolation and exposing sensitive user content.
Affected Products
- Google Chrome on Windows prior to version 152.0.7977.65
- Chromium-based browsers embedding vulnerable ANGLE builds on Windows
- Applications relying on the Chromium Embedded Framework with pre-patch ANGLE
Discovery Timeline
- 2026-08-25 - CVE-2026-79285 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79285
Vulnerability Analysis
ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls from Chrome's renderer into Direct3D calls on Windows. The vulnerability arises when ANGLE allocates a graphics resource without initializing its backing memory before the resource is exposed to JavaScript through WebGL or Canvas APIs.
When a page reads back pixel data or texture contents, the returned buffer may contain residual bytes left in GPU or system memory by another process, tab, or origin. This turns a rendering routine into a cross-origin read primitive. The attacker does not need to escape the sandbox; the leak occurs entirely through normal web APIs.
The issue is tracked in Chromium Issue Tracker #513918923 and addressed in the Google Chrome Stable Update.
Root Cause
The root cause is a missing initialization step in an ANGLE resource allocation path on Windows. Graphics memory returned to the renderer is not zeroed or overwritten before use. This aligns with [CWE-908], where a resource is used before its state is fully defined.
Attack Vector
Exploitation is network-based and requires user interaction limited to loading a page. An attacker hosts a crafted HTML document that issues specific WebGL or Canvas operations designed to allocate a vulnerable ANGLE resource. The page then reads back the uninitialized contents through standard pixel or texture read APIs. Data recovered can include fragments from other origins rendered in the same browser session.
No verified public exploit code is available for CVE-2026-79285. Refer to the Chromium issue tracker for technical details as Google restricts access to bug reports until users have updated.
Detection Methods for CVE-2026-79285
Indicators of Compromise
- Chrome installations on Windows reporting a version string below 152.0.7977.65 in chrome://version.
- Web pages requesting large or unusual WebGL texture allocations followed by immediate readPixels calls from untrusted origins.
- Browser telemetry showing repeated GPU process resource allocations tied to a single tab or origin.
Detection Strategies
- Inventory endpoints for Chrome and Chromium-derived browsers and compare installed versions against 152.0.7977.65.
- Monitor web proxy logs for HTML content invoking WebGL contexts from newly registered or low-reputation domains.
- Correlate browser crash reports and GPU process anomalies with user browsing history to surface exploitation attempts.
Monitoring Recommendations
- Enable Chrome enterprise reporting to centralize browser version and extension data for continuous compliance checks.
- Alert on outbound POST requests carrying binary payloads from browser processes to unfamiliar hosts, which may indicate exfiltration of leaked cross-origin data.
- Track patch adoption rates across managed endpoints and escalate machines that remain on vulnerable Chrome builds after the maintenance window.
How to Mitigate CVE-2026-79285
Immediate Actions Required
- Update Google Chrome on Windows to version 152.0.7977.65 or later on every managed endpoint.
- Force a browser restart after the update so the patched ANGLE library is loaded into memory.
- Audit Chromium-based applications and embedded browsers for the fixed ANGLE build and apply vendor updates as they ship.
Patch Information
Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update. Enterprises using the Chrome MSI or managed update channels should verify that clients successfully advance to 152.0.7977.65 or newer.
Workarounds
- Restrict WebGL usage in high-risk environments through the HardwareAccelerationModeEnabled enterprise policy while patches are staged.
- Deploy strict browsing policies that block access to unclassified or newly registered domains for privileged users.
- Encourage users to avoid embedding sensitive web applications in the same browser session as untrusted browsing until updates are confirmed.
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Force update via Google Update on a managed host
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
