External risk intelligence

ANGLE Out-of-Bounds Write in Chrome Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79188

The vulnerability exists in a web browser, which is an internet-facing client application. Browsers are designed to fetch and render content from the public internet, making them frequently exposed to untrusted remote content that can trigger the vulnerability through crafted HTML pages.

Out-of-bounds Write

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A high-severity vulnerability has been identified in ANGLE, a component used in Google Chrome, that could allow a remote attacker to execute arbitrary code. This occurs when a user visits a specially crafted HTML page, potentially leading to a compromise of systems outside the browser's security sandbox. The main concern is confirming relevance and exposure.

Out-of-bounds write in browser component.
Potential for code execution on user devices.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by presenting a user with a malicious HTML page, accessible over the network. This page would be designed to trigger an out-of-bounds write vulnerability within the ANGLE component of Google Chrome. Successful exploitation could allow the attacker to execute arbitrary code outside the browser's sandbox.

Requires network access to a user.
Triggered by a crafted HTML page.
Code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the browser's sandbox when a user visits a malicious HTML page. This could affect the confidentiality, integrity, and availability of the user's system.

Arbitrary code execution.
Via a crafted HTML page.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, affecting Google Chrome, requires coordination between application owners responsible for Chrome deployments, potentially platform teams managing browser environments, and security teams for exposure assessment. The first step is to identify all Chrome instances, confirm exposure and criticality, and determine the accountable owner for remediation planning.

Accountable teams own Chrome deployments.
Verify user exposure and asset criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a translation layer within Chrome that converts graphics instructions into the format required by your computer's graphics hardware. It enables the browser to display complex 3D content, animations, and web-based games efficiently across different operating systems and hardware configurations.

How does this out-of-bounds write vulnerability work?

This is a memory safety issue classified as CWE-787. It happens when the software attempts to write data past the end of a designated buffer. In this specific CVE, that flaw allows a malicious actor to potentially overwrite adjacent memory, which can be manipulated to run unauthorized code on your computer.

Do I need to do anything specific for this to trigger?

The vulnerability is triggered by browsing to a malicious website. Simply having the browser installed is not enough to cause the issue. It does not trigger during standard offline use or when visiting trusted, static content; the attacker specifically needs you to load a crafted HTML page designed to exploit the flaw.

Why is this CVE considered relevant for my network?

Halo Surface Signal flags this as likely relevant because browsers are inherently internet-facing applications. Since Chrome is designed to actively fetch and render untrusted content from the public web, it is frequently exposed to the exact type of external input needed to initiate this attack.

When should I prioritize updating my browser?

You should initiate the update process immediately. Since this allows code execution beyond the browser's security sandbox, it is a high-priority risk. Your first step is to inventory your systems to identify all Chrome instances and ensure they are patched to version 152.0.7977.65 or later to mitigate this risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.