External risk intelligence

ANGLE Out of Bounds Write Vulnerability in Chrome on Windows

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79019

The vulnerability exists in a web browser component (ANGLE) and is triggered by a crafted HTML page. Because web browsers are frequently used to navigate the public internet, a vulnerability that can be exploited via a web page is commonly exposed to internet-based content in standard deployment scenarios.

Out-of-bounds Write

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A high-severity vulnerability has been identified in ANGLE, a component used in Google Chrome on Windows, allowing for potential arbitrary code execution. This issue can be triggered by a user visiting a malicious webpage, bypassing standard security protections. The main concern is confirming if this technology is used within our environment and if it is exposed to external threats.

Out-of-bounds write in browser code.
Could allow remote code execution.
Confirm relevance and exposure to threats.

Attack Path

How an attacker could exploit the issue

An attacker could present a specially crafted HTML page to a user, leading to an out-of-bounds write vulnerability within the ANGLE component of Google Chrome. This could allow the attacker to execute code outside the browser's security sandbox.

Requires remote, unauthenticated access.
Triggered by visiting a malicious webpage.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox by tricking a user into visiting a malicious HTML page. This could affect system data when the browser is used for regular internet browsing on Windows.

System memory could be compromised.
Malicious web page could trigger vulnerability.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Windows, and exploitation can occur via a crafted HTML page. Responsibility for remediation likely falls to teams managing end-user computing environments, application deployment, and security operations. The first practical step is to inventory Chrome installations, confirm exposure via user browsing habits, and identify the accountable owner for patching or mitigation.

Own by: End-user computing/application owners.
Verify first: User exposure and Chrome deployment.
Action: Plan targeted updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an abstraction layer that translates graphics calls into the specific format required by the underlying hardware and drivers. It is a fundamental part of the browser's engine used to render 3D graphics and perform hardware-accelerated tasks efficiently. In Google Chrome for Windows, ANGLE enables the browser to communicate effectively with the operating system's graphics stack.

What does an out-of-bounds write mean in CVE-2026-79019?

This is a memory safety issue categorized as CWE-787. It occurs when software writes data past the intended boundary of a memory buffer. In this CVE, an attacker uses a specially crafted web page to force the browser to write data into memory locations it should not access, which can potentially allow them to bypass security protections and execute their own code.

How is this Chrome vulnerability triggered?

The vulnerability is triggered when a user visits a malicious website containing specific HTML code designed to exploit the ANGLE component. It does not trigger during background processes or when the browser is idle; it requires the active rendering of the crafted web content. Simply having the browser installed is not enough to activate the vulnerability without navigating to an attacker-controlled page.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates the risk is likely because the affected component is a web browser. Since browsers are designed to fetch and render content from the public internet, any computer used for general web browsing is inherently exposed to content that could trigger this vulnerability. Internal systems that never visit external websites face a significantly lower risk.

What is the first step to address CVE-2026-79019?

The most effective first step is to confirm where Google Chrome is installed within your organization. Because this vulnerability is tied to the browser version, you should identify systems running versions older than 152.0.7977.65. Once you have an inventory, coordinate with the teams that manage application updates to ensure Chrome is patched to the latest secure version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.