CVE-2026-79282 in Chrome
Summary
by MITRE • 08/26/2026
Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-3806 represents a critical memory corruption flaw within the ANGLE graphics library, which serves as the translation layer between web applications and native GPU drivers in Google Chrome on Android versions prior to 152.0.7977.65. This specific issue is classified as an out-of-bounds write resulting from use-after-free conditions during memory management operations within the rendering pipeline. The ANGLE library, which implements OpenGL ES for web browsers, handles complex graphical computations and state transitions that are fundamental to displaying modern web content. When a remote attacker crafts a malicious HTML page containing specially constructed JavaScript or WebGL calls, they can trigger a scenario where the application attempts to access memory regions that have already been deallocated by the system's garbage collector or explicit free operations. This temporal error allows for arbitrary write primitives because the freed memory block may be reallocated for other purposes before the dangling pointer is dereferenced, effectively allowing an attacker to overwrite critical data structures within the browser process context.
From a technical perspective, this vulnerability maps directly to CWE-416, which defines use-after-free errors as accessing memory after it has been freed without proper checks or updates to pointers. The exploitation of this flaw bypasses standard sandboxing mechanisms because ANGLE operates with elevated privileges relative to typical web content isolation boundaries when interacting with hardware acceleration features. By manipulating the state of graphical objects and forcing premature deallocation while retaining references, an attacker can achieve arbitrary code execution outside the restrictive Chrome sandbox environment. This capability is particularly dangerous as it allows malicious payloads to escape the browser's security perimeter and interact directly with the underlying operating system or other applications on the Android device. The severity rating of Critical by Chromium reflects the high likelihood of successful exploitation given the complexity of modern web pages and the prevalence of WebGL usage in contemporary internet services, making this a significant threat vector for drive-by download attacks.
The operational impact of this vulnerability extends beyond simple data leakage to include full system compromise on affected Android devices. An attacker leveraging this flaw could install malware, exfiltrate sensitive user data such as credentials or financial information stored locally, or establish persistent backdoors within the device's operating environment. The ability to execute code outside the sandbox negates many of Chrome's primary defense-in-depth strategies, including site isolation and process separation models designed to contain breaches within individual tabs or processes. Consequently, users relying on older versions of Google Chrome are exposed to sophisticated phishing campaigns and malicious advertising networks that utilize this vulnerability as a delivery mechanism for advanced persistent threats targeting mobile endpoints.
Mitigation requires immediate action by updating the browser software to version 152.0.7977.65 or later where these memory management issues have been resolved through rigorous code audits and enhanced pointer validation techniques within ANGLE. Security teams should enforce automated patching policies for all Android devices under their management to ensure timely application of security updates. Additionally, users are advised to enable automatic browser update notifications and avoid visiting untrusted websites that may host exploit kits designed to target known vulnerabilities in web rendering engines. Monitoring network traffic for anomalous behavior associated with WebGL resource allocation patterns can also provide early detection indicators for attempted exploitation activities targeting this specific weakness.