CVE-2026-79131 in Chrome
Summary
by MITRE • 08/26/2026
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an out-of-bounds write within the ANGLE graphics library in versions of Google Chrome prior to 152.0.7977.65 represents a critical memory corruption flaw with significant implications for browser security and sandbox integrity. ANGLE serves as the translation layer between web applications and underlying native graphics APIs, such as OpenGL or Vulkan, enabling high-performance rendering within the Chromium-based ecosystem. When this component processes malformed input from a crafted HTML page containing malicious JavaScript or WebGL commands, it fails to properly validate memory access boundaries during buffer operations. This lack of rigorous bounds checking allows an attacker to write data beyond the allocated limits of a specific memory region, leading to heap corruption and potential control flow hijacking.
From a technical perspective, this flaw is classified under CWE-787: Out-of-bounds Write, which describes situations where software writes data past the end or before the beginning of the intended buffer. In the context of browser exploitation, such vulnerabilities are particularly dangerous because they can be triggered remotely via standard web technologies without requiring user interaction beyond visiting a malicious site. The attacker crafts an HTML page that leverages specific WebGL shaders or canvas operations to trigger the memory corruption within ANGLE. By carefully crafting the payload, the adversary can overwrite adjacent heap metadata or function pointers, which is a common technique used to achieve arbitrary code execution. This process often involves techniques aligned with ATT&CK T1203: Exploitation for Client Execution, where the attacker exploits software vulnerabilities in client-side applications to run malicious code on the victim's system.
The operational impact of this vulnerability extends beyond simple data corruption due to its potential to bypass Chrome’s sandboxing mechanisms. Modern browsers rely heavily on process isolation and sandboxes to limit the damage caused by successful exploitation attempts. However, an out-of-bounds write in a privileged component like ANGLE can allow code execution outside these restrictive boundaries if the attacker successfully chains this memory corruption with other techniques such as heap spraying orROP gadgets. This effectively neutralizes one of the primary defenses against web-based attacks, allowing remote attackers to execute arbitrary commands on the underlying operating system. The severity rating of High reflects the ease of exploitation and the high likelihood of successful privilege escalation from a sandboxed context to full system compromise.
Mitigation strategies primarily involve immediate software updates to ensure that all instances of Google Chrome are upgraded to version 152.0.7977.65 or later, where this memory safety issue has been addressed through improved input validation and bounds checking within the ANGLE library. For organizations managing large fleets of devices, automated patch management systems should be configured to prioritize updates for Chromium-based browsers due to their widespread usage and high attack surface. Additionally, security teams can implement browser hardening policies that restrict WebGL access or disable specific JavaScript features known to interact with graphics APIs in unpredictable ways, although this may impact legitimate web application functionality. Continuous monitoring of threat intelligence feeds related to zero-day exploits targeting ANGLE is also recommended to detect any potential exploitation attempts before they result in a breach.