CVE-2026-79131

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

An out‑of‑bounds write in ANGLE, triggered by a crafted HTML page, allows a remote attacker to execute arbitrary code outside Chrome’s sandbox. The flaw is a classic memory corruption vulnerability—CWE‑787—providing the attacker with the ability to take control of the browser process.

Affected Systems

Google Chrome versions prior to 152.0.7977.65 on all platforms are affected. The issue is present on desktop builds and is active in the stable channel until the update is installed.

Risk and Exploitability

The vulnerability carries a high severity rating, with a CVSS score of 9.6. It requires only that a malicious web page be loaded in the user’s browser, which is a realistic condition for many users. The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog, yet the availability of exploit code and the lack of sandbox escape mitigations keep the risk significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 152.0.7977.65 or newer, which contains the ANGLE memory corruption fix.
  • If an update cannot be applied immediately, launch Chrome with the –disable‑gpu option or use the "GPU rasterization" policy to turn off hardware acceleration, thereby disabling ANGLE.
  • Apply any pending OS‑level security updates that enforce browser sandboxing best practices and monitor for new Chrome patches in the stable channel release notes.

Generated by OpenCVE AI on August 26, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
Debian DSA Debian DSA DSA-6534-1 webkit2gtk security update
History
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Out-of-Bounds Write in ANGLE Enables Remote Code Execution in Chrome
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Out-of-Bounds Write in ANGLE Enables Remote Code Execution in Chrome
Type Values Removed Values Added
Description Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-787
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:57 AM
Reserved
Aug 25, 2026, 6:10 AM

View source JSON

Updated
Aug 26, 2026, 3:57 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 27, 2026, 12:58 PM

View source JSON

No data.

Updated
Aug 26, 2026, 7:30 PM

JSON