CVE-2026-79138

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

An out-of-bounds write in ANGLE, the graphics component of Chrome, allows a remote attacker to craft a malicious HTML page that, when rendered on Windows, can escape the browser sandbox and execute arbitrary code. This high-severity flaw is a classic memory-corruption vulnerability that could compromise system confidentiality, integrity, or availability.

Affected Systems

The flaw affects Google Chrome running on Windows. No other operating systems or Chrome products are explicitly listed as impacted.

Risk and Exploitability

The CVSS score of 9.6 signals critical risk. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The likely attack vector is a remote attacker delivering a crafted web page to a user. If exploited, the attacker could gain full system control by breaking out of the browser sandbox.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome on Windows to the latest stable release, which contains the ANGLE patch that fixes the out-of-bounds write.
  • Enable Chrome automatic updates or implement an enterprise patch-management schedule to keep Chrome current.
  • Until updating, restrict users from accessing untrusted web content and enforce network filtering or sandbox extensions to mitigate risk.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Type Values Removed Values Added
Title Chrome ANGLE Out‑of‑Bounds Write Enables Remote Code Execution on Windows
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Chrome ANGLE Out‑of‑Bounds Write Enables Remote Code Execution on Windows
Type Values Removed Values Added
Description Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-787
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:57 AM
Reserved
Aug 25, 2026, 6:10 AM

View source JSON

Updated
Aug 26, 2026, 3:58 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 27, 2026, 12:38 PM

View source JSON

No data.

Updated
Aug 26, 2026, 8:30 PM

JSON