External risk intelligence

ANGLE Out of Bounds Write in Chrome Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79138

The vulnerability exists within the browser's graphics library (ANGLE) and requires a user to navigate to a specifically crafted HTML page. It is a client-side component executed within the browser rather than a network-reachable service, gateway, or internet-facing infrastructure component.

Out-of-bounds Write

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A high-severity vulnerability has been identified in ANGLE, a component within Google Chrome on Windows. This issue could allow a remote attacker to execute code outside the browser's security sandbox by tricking a user into visiting a malicious web page. The primary concern is to determine if this specific vulnerability affects your environment.

Browser flaw could let attackers run code.
Understand if our users could be affected.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could lure a user to a malicious website containing a specially crafted HTML page. This page would trigger a flaw in ANGLE, a graphics component within Google Chrome. If successful, this could allow the attacker to execute code beyond the browser's security boundaries.

No user authentication needed.
Visiting a malicious website.
Arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox when a user visits a malicious HTML page. This vulnerability in ANGLE, a graphics library used by Google Chrome on Windows, could allow an attacker to compromise the user's system.

System integrity and user data could be at risk.
Visiting a crafted HTML page could lead to exposure.
Arbitrary code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, a component of Google Chrome, allows for potential arbitrary code execution through a crafted HTML page. While the vulnerability is classified as external due to its network vector, its client-side execution within the browser, requiring user interaction, significantly limits its direct impact on infrastructure. Identifying affected users and devices, assessing business criticality, and coordinating with Chrome updates are the initial practical steps.

Chrome owners, user device owners, and security teams.
Verify user exposure to malicious web content.
Coordinate browser updates or user advisories.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a graphics engine abstraction layer used by Google Chrome on Windows. It translates graphics calls from web content into formats the computer's hardware can understand, such as DirectX, ensuring that web-based 3D graphics and animations render correctly across different systems.

What does an out-of-bounds write mean for CVE-2026-79138?

This vulnerability is classified as CWE-787. It occurs when software writes data past the intended memory buffer. In this case, an attacker sends specially crafted data through a web page that causes the graphics library to overwrite adjacent memory, potentially leading to unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this flaw by luring a user to a malicious HTML page. The browser then processes the page, activating the faulty code within the graphics library. Simply having Chrome installed or open does not trigger the bug; the user must actively navigate to the malicious content for the exploit to proceed.

Is CVE-2026-79138 a concern for my internal servers?

Halo Surface Signal indicates this is very unlikely to affect infrastructure, as the flaw exists within the browser's client-side graphics component. It is not a vulnerability in a network-reachable service, gateway, or backend system, meaning it primarily poses a risk to individual user devices rather than internal server environments.

What should I do if my devices use this Chrome version?

Your first step is to confirm which systems run the affected Chrome versions on Windows. Once identified, coordinate with your IT or desktop support teams to prioritize browser updates. Since this requires user interaction, informing staff about the risks of visiting untrusted websites is also a helpful defensive measure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.