CVE-2026-79043 in Chrome
Summary
by MITRE • 08/26/2026
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an out-of-bounds write within the ANGLE graphics library in Google Chrome prior to version 152.0.7977.65 represents a critical memory safety failure that undermines the browser's sandboxing mechanisms. ANGLE, which stands for Almost Native Graphics Layer Engine, serves as a translation layer between web applications and underlying hardware-accelerated graphics APIs such as OpenGL ES or Vulkan. This component is integral to rendering complex visual content on modern websites, including 3D models, animations, and interactive media via WebGL. When an attacker crafts a malicious HTML page containing specially designed JavaScript that triggers specific WebGL operations, they can exploit the flaw in ANGLE's memory management logic. The core technical issue lies in the improper validation of array indices or buffer boundaries during graphics command processing. Instead of checking whether the requested write operation falls within the allocated memory limits for a given texture, vertex buffer, or uniform data structure, the engine proceeds to execute the write instruction. This results in writing data beyond the intended memory allocation into adjacent regions of heap memory.
This out-of-bounds write condition allows an attacker to corrupt critical program structures stored immediately after the targeted object. By carefully controlling the size and content of the crafted input, a remote attacker can overwrite function pointers, virtual table entries, or other control flow metadata within the browser process. Because ANGLE operates with elevated privileges relative to standard web page scripts due to its role in hardware acceleration, successfully exploiting this flaw enables code execution outside the restrictive sandbox environment that normally isolates untrusted web content from the operating system and user data. The Chromium security team has classified this issue as High severity because it directly facilitates arbitrary code execution, which is one of the most dangerous outcomes for a browser vulnerability. Such an exploit could allow malware installation, credential theft, or complete compromise of the victim's machine depending on the context in which the browser is running and what other processes are accessible from within the compromised renderer process.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, which describes writing data to a memory location beyond the end of an allocated buffer. It also relates closely to CWE-120: Buffer Overflow without bounds checking, as the root cause is the failure to enforce boundary constraints on user-supplied input before performing memory operations. In terms of offensive security frameworks like MITRE ATT&CK, this exploit technique falls under T1203: Exploitation for Client Execution, specifically leveraging client-side software vulnerabilities in web browsers or media players. The attack vector involves a remote attacker delivering the malicious HTML payload through various means such as phishing emails, compromised websites, or drive-by downloads. Once the victim visits the crafted page, the browser's JavaScript engine parses and executes the code, which then interacts with the WebGL context to trigger the ANGLE flaw during rendering operations.
The operational impact of this vulnerability is severe due to its potential for remote code execution without user interaction beyond visiting a webpage. Modern browsers rely heavily on sandboxing to limit the damage caused by successful exploits. However, when an out-of-bounds write occurs in a privileged component like ANGLE, it can lead to heap corruption that bypasses these protections. Attackers can use techniques such as arbitrary read/write primitives or control flow hijacking to escalate privileges within the browser process and potentially escape to the host system. This compromises confidentiality, integrity, and availability of user data and system resources. The presence of this flaw in versions prior to 152.0.7977.65 indicates that earlier builds lacked the necessary bounds checks or heap hardening measures required to prevent such memory corruption attacks.
To mitigate the risks associated with this vulnerability, organizations and individual users must ensure that Google Chrome is updated to version 152.0.7977.65 or later immediately upon availability. This update includes patches for ANGLE that enforce strict boundary checks on all graphics-related memory operations. Additionally, administrators should implement browser lockdown policies where feasible, disabling WebGL if it is not strictly required by business applications, thereby removing the attack surface entirely. Enabling automatic updates ensures that users receive security fixes promptly as they are released. Security teams should also monitor for indicators of compromise related to this specific CVE in their endpoint detection and response systems, looking for unusual memory access patterns or process injections originating from browser processes. Regular vulnerability assessments and patch management cycles are essential to maintaining a secure posture against such high-severity client-side exploits.