External risk intelligence

Google Chrome ANGLE Buffer Overflow Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79130

The vulnerability exists in a web browser, which is an internet-facing application used to access web content. Because the attack surface involves processing crafted HTML pages via the internet, it is commonly exposed to remote content in standard deployment patterns.

Buffer Overflow

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in ANGLE, a component used in Google Chrome, could allow an attacker to execute code remotely through a malicious web page. This type of vulnerability poses a risk to user data and system integrity, as it bypasses normal security boundaries. While details are still under analysis, its classification as CRITICAL warrants attention for potential impact on our external-facing web access.

Remote code execution via web pages.
Critical flaw impacts web browser security.
Assess potential exposure and relevance.

Attack Path

How an attacker could exploit the issue

Attackers can remotely execute arbitrary code by tricking a user into visiting a malicious webpage that exploits a buffer overflow vulnerability in the ANGLE component of Google Chrome. This could allow them to perform actions with the privileges of the user or the browser process, potentially leading to broader system compromise.

No special access needed.
Visiting a malicious webpage.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox by luring a user to a malicious HTML page, potentially impacting user data and system integrity when supported by the advisory.

User data could be at risk.
Malicious HTML page via network.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This high-severity buffer overflow vulnerability in ANGLE, affecting Google Chrome, requires a coordinated response. Application owners or platform teams responsible for managing browser deployments should initiate an asset inventory to identify instances of the affected Chrome version. Security and network teams will need to confirm external reachability and potential business criticality of these instances to prioritize remediation efforts, which may involve coordinating with vendor management for patching.

Identify affected Chrome instances.
Verify external reachability and criticality.
Plan coordinated vendor-supported remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an open-source graphics engine abstraction layer that translates industry-standard graphics API calls into the specific APIs required by the underlying operating system or hardware. Google Chrome uses it to ensure consistent, hardware-accelerated rendering of web content, such as 3D graphics and complex animations, across diverse desktop environments.

What does this CVE-2026-79130 buffer overflow mean?

This vulnerability is a buffer overflow, classified as CWE-122 (Heap-based Buffer Overflow). It occurs when the ANGLE component attempts to write more data into a memory buffer than it can hold. An attacker can use a specially crafted web page to overwrite adjacent memory, allowing them to bypass browser security sandbox protections and execute unauthorized code on the user's system.

How does an attacker trigger this vulnerability?

The flaw is triggered when a user navigates to a malicious HTML page that sends specific, malformed graphics instructions to the ANGLE component. Simply having the browser installed is not enough to trigger the issue; the attack requires the browser to actively process the crafted content. Standard, benign web browsing does not trigger this memory error.

Why is this Chrome vulnerability relevant to my network?

Halo Surface Signal notes this as a likely concern because web browsers are inherently internet-facing applications. Since this flaw can be exploited via remote content processed over the network, any system using an affected version of Chrome to browse the internet is potentially reachable by an attacker hosting a malicious site.

Do I need to update my software to fix this?

Yes. The most effective step is to identify all systems running Google Chrome versions older than 152.0.7977.65 and update them to the latest patched release. Because this is a browser-level issue, coordinate with your IT or desktop management teams to ensure the browser software is updated across your environment to mitigate the risk of remote code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.