CVE-2026-79138 in Chrome
Summary
by MITRE • 08/26/2026
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an out-of-bounds write within the ANGLE graphics library in Google Chrome represents a critical memory safety flaw that undermines the browser's primary defense mechanism, the sandbox. This issue affects versions of Chromium prior to 152.0.7977.65 on Windows systems and is classified with high severity by the Chromium security team. The root cause lies in improper bounds checking during graphics processing operations handled by ANGLE, which serves as a translation layer between web applications and underlying hardware graphics APIs such as DirectX or OpenGL. When a remote attacker crafts a malicious HTML page containing specific WebGL commands or shader code, they can trigger this memory corruption flaw within the browser process.
From a technical perspective, an out-of-bounds write occurs when a program writes data to a memory location beyond the intended buffer boundaries. In the context of ANGLE and Chrome's architecture, this typically involves manipulating GPU command buffers or internal state structures that manage rendering contexts. Because modern browsers rely heavily on sandboxing to isolate untrusted web content from the operating system, any escape from these confined processes is particularly dangerous. The flaw allows an attacker to overwrite adjacent memory regions with controlled data, potentially overwriting function pointers, return addresses, or other critical control flow elements within the browser process space.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution outside the sandbox. While Chrome's sandbox restricts access to sensitive system resources and limits the damage a compromised renderer can do, an out-of-bounds write that leads to memory corruption in higher-privilege processes or allows exploitation techniques like heap spraying combined with information leaks can facilitate a sandbox escape. Once the attacker gains code execution privileges beyond the restricted browser context, they effectively compromise the entire host system. This enables activities such as installing malware, stealing sensitive data, establishing persistence, and pivoting to other systems on the network. The ability to execute arbitrary code remotely via a crafted web page means that no user interaction beyond visiting a malicious site is required, significantly increasing the attack surface.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-787: Out-of-bounds Write, which describes writing data outside of the intended buffer boundary. It also maps to MITRE ATT&CK techniques related to initial access and privilege escalation, specifically leveraging client-side execution flaws to bypass security boundaries. The exploitation path often involves chaining this memory corruption with other vulnerabilities or using advanced heap manipulation techniques to achieve reliable code execution in a privileged context.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where the bounds checking logic within ANGLE has been corrected to prevent writes beyond allocated memory regions. Organizations should ensure that endpoint protection solutions are updated to detect exploitation attempts associated with this specific vulnerability signature if available. Additionally, users can mitigate risk by disabling JavaScript in untrusted environments or using browser extensions that restrict WebGL access for unknown sites, although these measures may impact functionality. Regular patch management and keeping all software components up to date remain the most effective defense against such memory corruption vulnerabilities.