CVE-2026-79142 in Chrome
Summary
by MITRE • 08/26/2026
Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-3880 represents a critical memory safety failure within the ANGLE graphics library, which serves as the translation layer between web applications and native OpenGL ES drivers in Google Chrome on Android. This specific flaw is classified as a buffer overflow, indicating that the application failed to properly validate input boundaries when processing data structures associated with graphical rendering operations. The root cause lies in improper memory management practices within the ANGLE component, where crafted inputs can trigger writes beyond allocated memory buffers. Because this vulnerability exists within a core system library rather than an isolated sandboxed renderer process boundary in certain execution contexts or due to specific exploitation chains, it allows for code execution outside the expected security confinement zones. The Chromium project has assigned this issue a High severity rating, reflecting its potential to compromise the integrity of the browser environment and potentially lead to full device compromise if exploited effectively by a remote attacker.
From a technical perspective, buffer overflows in graphics libraries are particularly dangerous because they often involve complex data structures related to vertex buffers, shader programs, or texture mappings. When an HTML page is crafted with maliciously constructed JavaScript that triggers specific WebGL calls through ANGLE, the underlying C++ code may fail to check array indices or string lengths before copying data into fixed-size memory regions. This allows an attacker to overwrite adjacent memory locations, which can include return addresses on the stack or function pointers in heap structures. Such overwrites enable arbitrary code execution by redirecting program flow to shellcode injected via the overflowed buffer. The presence of this flaw suggests a gap in input validation logic within the ANGLE translation layer, where data originating from untrusted web content is processed without sufficient sanitization before being passed to lower-level graphics APIs.
The operational impact of this vulnerability is severe due to its remote exploitability and potential for sandbox escape. A victim does not need any special privileges or prior interaction beyond visiting a maliciously designed website hosted by an attacker. Once the crafted HTML page loads, it can automatically trigger the vulnerable code path through JavaScript execution, leading to arbitrary code execution on the Android device. This bypasses Chrome’s multi-process architecture and sandboxing mechanisms that are typically designed to contain web content within restricted environments. Successful exploitation could allow attackers to install malware, exfiltrate sensitive user data such as credentials or financial information stored in cookies and local storage, or use the compromised browser instance as a pivot point for further network attacks. The ability to execute code outside the sandbox fundamentally undermines the security model of modern browsers, making this a high-priority issue requiring immediate attention from both developers and users.
Mitigation strategies primarily involve updating Google Chrome on Android to version 152.0.7977.65 or later, where these memory safety issues have been addressed through code patches that enforce stricter bounds checking within the ANGLE library. Developers integrating similar graphics libraries should adopt secure coding practices such as using safe string handling functions, implementing rigorous input validation for all data derived from external sources, and leveraging static analysis tools to detect potential buffer overflows during development. Additionally, enabling memory protection features like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on Android devices can mitigate the impact of such vulnerabilities by making it harder for attackers to reliably execute injected code even if a buffer overflow occurs. Security teams should also monitor for indicators of compromise related to unusual network activity or unexpected process behavior that might signal an active exploitation attempt targeting this specific flaw in older browser versions.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-120, which describes Buffer Copy without Checking Size of Input Classic Buffer Overflow, and potentially CWE-787 if the overflow leads to out-of-bounds write operations affecting critical control structures. In terms of attack tactics, this scenario corresponds to MITRE ATT&CK techniques involving Initial Access via Spearphishing Link or Drive-by Compromise, followed by Execution through Arbitrary Code Execution on a remote system. The exploitation chain likely involves leveraging JavaScript engine features to manipulate ANGLE’s internal state, demonstrating how web-based attacks can escalate privileges beyond the browser sandbox when underlying libraries contain memory safety defects. Continuous monitoring and prompt patching remain essential defenses against such sophisticated threats that target foundational components of mobile operating systems and browsers.