External risk intelligence

ANGLE Out of Bounds Read Vulnerability in Google Chrome for Windows

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-78989

The vulnerability resides in the web browser's graphics library and requires a user to navigate to a crafted HTML page. As web browsers are primary internet-facing applications commonly used to access public content, the vulnerable surface is regularly exposed to internet-sourced content.

Out-of-bounds Read

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in ANGLE, a graphics component used by Google Chrome on Windows. This vulnerability could allow an attacker to execute code remotely by tricking a user into visiting a malicious webpage. The main concern is confirming whether our environments are affected and to what extent.

Reading outside memory limits.
Allows code execution from web pages.
Confirm exposure; understand potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would contain specially crafted content that targets a flaw in the ANGLE graphics library within the Chrome browser on Windows. If successful, this could allow the attacker to execute code beyond the browser's security boundaries.

Requires visiting a malicious page.
Triggers with crafted HTML content.
Risk of code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially execute arbitrary code outside the sandbox when a user visits a crafted HTML page in supported versions of Google Chrome on Windows. This could affect the integrity and confidentiality of the user's system.

System code execution outside sandbox.
Crafted HTML page interaction.
Sensitive data and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in ANGLE, affecting Google Chrome on Windows, requires swift action from teams managing browser deployments and endpoint security. The immediate first step is to inventory all Windows endpoints utilizing the affected Chrome version, identify those with direct internet exposure or user interaction, and then confirm the specific ownership of these browser deployments to initiate a coordinated remediation plan.

Browser and Endpoint Security Teams own remediation.
Verify Chrome browser deployment and user exposure.
Plan and execute Chrome updates or risk mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an open-source graphics abstraction layer used by Google Chrome on Windows. It translates graphics calls from web applications into formats that the underlying hardware or operating system drivers understand. This allows Chrome to efficiently render complex web-based visuals, like 3D games or interactive graphics, across different hardware configurations.

What does an out-of-bounds read mean for CVE-2026-78989?

This vulnerability, classified as CWE-125, occurs when the software reads data past the intended end of a memory buffer. In this case, the ANGLE library incorrectly accesses memory it does not own. An attacker can leverage this flaw to potentially bypass browser security protections and execute arbitrary code on the host system.

How is this vulnerability triggered?

The flaw is triggered when a user navigates to a specifically crafted HTML page designed to exploit the memory access error. Simply having the browser installed or running in the background does not trigger the bug; it requires active interaction with malicious web content that manipulates the graphics rendering process.

Why is this CVE considered relevant for my environment?

Halo Surface Signal identifies this as a likely risk because web browsers are inherently internet-facing applications. Since the vulnerability requires visiting a web page to succeed, any Windows endpoint using an outdated version of Chrome that accesses the public internet is considered to have an exposed attack surface.

What is the first step to address CVE-2026-78989?

Begin by identifying all Windows workstations or servers in your environment that have Google Chrome installed. Compare these versions against the fixed release mentioned in the vendor security advisory. Prioritize updates for systems frequently used to browse the internet, as these carry the highest risk of encountering the malicious content required to trigger the exploit.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.