Executive brief
Google Chrome is a widely-used web browser that runs on Windows, Mac, and Linux. This vulnerability is an out-of-bounds memory write flaw in ANGLE (the graphics rendering engine), which allows an attacker to execute arbitrary code within the browser's sandbox by tricking a user into visiting a malicious website. Successful exploitation could lead to sandbox escape, data theft, or system compromise.
Technical details
This is an out-of-bounds write vulnerability in ANGLE, Google Chrome's OpenGL abstraction layer used for graphics rendering. The flaw allows a remote attacker to write data outside intended memory boundaries via a crafted HTML page, leading to potential arbitrary code execution within the browser sandbox. The attack is triggered when a user visits a malicious website and does not require prior authentication or special user privileges. While the exploit executes within the sandbox, it can be leveraged as a stepping stone for full sandbox escape. The vulnerability has been patched in Chrome version 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux), released on August 25, 2026.
Affected products
- Google Chrome prior to 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux)
Timeline
- 2026-08-25: disclosed: CVE-2026-79048 disclosed with Chrome 152 release
- 2026-08-25: patched: Fixed in Chrome 152.0.7977.65 (Windows/Mac) and 152.0.7977.64 (Linux)