External risk intelligence

ANGLE Out-of-Bounds Write in Chrome Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79189

The vulnerability affects a web browser, which is a client-side application designed specifically to interact with the public internet by rendering crafted HTML pages. As web browsers are primary tools for accessing external web content, they are frequently exposed to internet-sourced data.

Out-of-bounds Write

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in ANGLE, a component used within Google Chrome. The issue allows for an out-of-bounds write, potentially enabling remote attackers to execute code outside the browser's security sandbox through malicious web pages. The primary concern is to confirm if this specific technology is in use and if there is any potential exposure.

Allows code execution via malicious web pages.
Affects a widely used web browser component.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers could exploit this vulnerability by luring users to a malicious webpage. When a user visits this crafted page using a vulnerable version of Google Chrome, the ANGLE component is triggered by out-of-bounds write, potentially allowing the attacker to execute code beyond the browser's security sandbox.

Requires a user to visit a malicious website.
Triggered by rendering a crafted HTML page.
Leads to arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this vulnerability by enticing a user to visit a malicious HTML page, potentially leading to arbitrary code execution outside of the sandbox environment. This could affect the confidentiality, integrity, and availability of the user's system.

System code and memory at risk.
Via a crafted HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, affecting Google Chrome, requires immediate attention from teams responsible for endpoint security and application deployment. The first practical step is to identify all Chrome installations, determine their reachability and criticality, and then ascertain the accountable owner for remediation. Coordination with vendor management may be necessary if third-party software or managed services are involved.

Endpoint security and application owners
Verify Chrome installation reachability
Plan staged deployment for updates

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a graphics engine abstraction layer within Google Chrome. It translates different graphics API calls, such as OpenGL, into the native language of your computer's hardware, like DirectX or Vulkan. By acting as a bridge between the browser and your graphics hardware, it ensures web-based 3D content and hardware-accelerated features run consistently across different operating systems.

What does an out-of-bounds write mean in CVE-2026-79189?

This weakness, categorized as CWE-787, occurs when software writes data past the end of an intended memory buffer. In this case, the ANGLE component incorrectly calculates memory limits, allowing an attacker to overwrite adjacent data. Because Chrome uses a sandbox to isolate processes, this specific flaw is dangerous because it can be used to bypass those protections and run unauthorized code on the host system.

How is this vulnerability triggered?

The vulnerability is triggered when a user navigates to a specifically crafted HTML page that exploits the memory handling error in the ANGLE component. Simply having Chrome installed is not enough to trigger the bug; the browser must actively render the malicious web content for the flaw to occur. Viewing standard, legitimate websites will not cause this issue.

Why is this Chrome vulnerability relevant?

According to Halo Surface Signal, this vulnerability is highly relevant because Google Chrome is a client-side application designed to render untrusted content from the public internet. Since browsers are constantly interacting with external data sources, the potential for encountering a malicious page is a common and persistent risk for any system running a vulnerable version of the software.

Do I need to update my Chrome installations?

Yes, you should prioritize updating. The first step is to create an inventory of all systems running Chrome to identify which ones are using versions prior to 152.0.7977.65. Once identified, ensure these systems receive the latest vendor update. Because this flaw allows code execution outside the sandbox, addressing the browser version is the most effective way to eliminate the underlying risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.