CVE-2026-79275 in Chrome
Summary
by MITRE • 08/26/2026
Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-8383 represents a critical memory safety flaw within the ANGLE graphics library, which is integrated into Google Chrome prior to version 152.0.7977.65. This issue stems from an improper handling of deallocated memory objects, specifically categorized under CWE-416 as Use After Free. In this scenario, a pointer continues to reference a memory location that has already been freed by the system or application logic. When the program subsequently attempts to access or modify data through this stale pointer, it results in undefined behavior, which can lead to arbitrary code execution if an attacker successfully controls the content of the freed memory region.
The technical mechanism involves the ANGLE library, a translation layer that converts OpenGL ES API calls into other graphics APIs such as DirectX or Vulkan. This component is heavily utilized by Chrome for rendering web pages and handling GPU-accelerated operations. The vulnerability arises when the application fails to nullify pointers after freeing associated memory structures within the ANGLE subsystem. An attacker can exploit this timing gap by crafting a malicious HTML page that triggers specific graphics commands, causing the targeted object to be freed while retaining an active reference in another part of the execution flow. By carefully manipulating heap allocations and deallocations through JavaScript and WebGL calls, the attacker can overwrite the freed memory with controlled data structures, effectively hijacking control flow when the stale pointer is dereferenced.
The operational impact of this vulnerability is severe due to its potential for remote code execution outside the browser sandbox. Google Chrome employs a multi-process architecture where renderer processes are isolated in sandboxes to limit the damage caused by exploits. However, because ANGLE operates at a low level and interacts directly with system graphics drivers, an exploit that achieves arbitrary code execution through this use-after-free condition can potentially escape these containment boundaries. This allows a remote attacker who tricks a user into visiting a crafted webpage to execute malicious payloads on the victim's operating system with the privileges of the browser process. The Chromium security team has classified this issue as High severity, reflecting its significant potential for compromise and the ease with which it might be leveraged in drive-by attack scenarios.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where the underlying memory management logic within ANGLE has been corrected to prevent access to freed resources. For organizations unable to immediately patch all endpoints, implementing strict content security policies and restricting WebGL usage in untrusted contexts can reduce the attack surface. Additionally, enabling browser features such as site isolation ensures that renderer processes are isolated by origin, which may hinder some exploitation techniques even if a vulnerability is present. Security teams should also monitor for indicators of compromise related to unusual GPU activity or unexpected process spawns following web browsing sessions, as these could signal attempted exploitation attempts against unpatched systems.
This incident underscores the persistent risks associated with complex graphics libraries in modern browsers and highlights the importance of rigorous memory safety practices such as those promoted by CWE-416. It also aligns with ATT&CK techniques related to initial access via browser exploits, specifically T1189 Drive-by Compromise. Continuous monitoring and timely application of security updates remain the most effective defenses against such sophisticated remote exploitation vectors that target foundational components like ANGLE within widely used software ecosystems.