CVE-2026-79188

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Description
Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Analysis

AI-generated

Technical impact

The vulnerability is an out‑of‑bounds memory write in the ANGLE component of Google Chrome versions older than 152.0.7977.65. A specially crafted HTML page can trigger this write, allowing a remote attacker to write beyond allocated buffers and potentially execute arbitrary code outside the browser sandbox. The flaw stems from a lack of proper bounds checking in the ANGLE graphics layer, and it is classified as CWE‑787.

Affected Systems

Google Chrome is the affected product; any installation running a version earlier than 152.0.7977.65 is vulnerable. This includes the stable channel releases updated before the August 2026 patch published by Google. Users of older Chrome builds without that update remain exposed.

Risk and Exploitability

The CVSS score is 9.6, indicating a high severity, and the EPSS score is < 1%. The vulnerability is not in the CISA KEV catalog. The attack can be delivered by a remote user who composes a malicious web page and lures a victim into visiting it. Because the flaw can escape the sandbox, successful exploitation could lead to full system compromise. Administrators should treat this as a priority issue.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest Google Chrome update (≥152.0.7977.65).
  • Ensure Chrome automatic updates are enabled so future security patches are applied promptly.
  • If upgrading is delayed, restrict access to untrusted web content by enabling Safe Browsing and site isolation or by running Chrome in a confined virtual machine.

Generated by OpenCVE AI on August 26, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
Debian DSA Debian DSA DSA-6534-1 webkit2gtk security update
History
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Out of Bounds Write in ANGLE Leading to Remote Code Execution in Google Chrome
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Out of Bounds Write in ANGLE Leading to Remote Code Execution in Google Chrome
Type Values Removed Values Added
Description Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-787
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 27, 2026, 3:57 AM
Reserved
Aug 25, 2026, 6:11 AM

View source JSON

Updated
Aug 26, 2026, 3:23 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 27, 2026, 1:14 PM

View source JSON

No data.

Updated
Aug 26, 2026, 8:30 PM

JSON