External risk intelligence

Google Chrome WebGL Use After Free Leads to Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79235

The vulnerability exists in the WebGL implementation of a widely used web browser. Web browsers are designed to process untrusted content from the public internet, and this specific flaw is triggered by a crafted HTML page, making it a common vector for web-based attacks against internet-facing clients.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WebGL component of Google Chrome, potentially allowing attackers to execute malicious code on affected systems through specially crafted web pages. While the severity is high, the primary concern at this stage is to confirm if our organization's environment is exposed to this type of threat.

A browser flaw could let attackers run malicious code.
It impacts a widely used browser component.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could lure a victim into visiting a malicious HTML page hosted online. This page would interact with a vulnerable component in the WebGL implementation of the browser. If successful, this interaction could allow the attacker to execute code on the victim's machine, potentially escaping the browser's security sandbox.

Victim visits a malicious webpage.
WebGL component is triggered by crafted content.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in WebGL within Google Chrome could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This could lead to a compromise of the user's system.

System code execution outside sandbox.
Malicious HTML page interaction.
Compromise of user's system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's WebGL implementation requires immediate attention from teams managing end-user systems and network security. The first practical step is to identify all instances of the affected browser version, confirm exposure to the internet or business criticality, and locate the accountable system owner before planning remediation.

Owner: End-user computing or browser management teams.
Verify: Browser reachability and business impact.
Action: Plan and execute targeted updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome WebGL?

WebGL is a JavaScript API used within the Google Chrome browser to render interactive 2D and 3D graphics directly within a webpage. It allows developers to create complex visual experiences without requiring external plugins, making it a standard component for modern web gaming, data visualization, and design tools that run inside your browser.

What does CVE-2026-79235 mean by use-after-free?

This vulnerability is a use-after-free, classified as CWE-416. It occurs when a program continues to use a memory location after that memory has been cleared or released. If an attacker can manipulate this process, they can replace the original data with their own malicious code, causing the browser to execute unauthorized instructions.

How does an attacker trigger this vulnerability?

The flaw is triggered when a user visits a specifically crafted HTML page designed to interact with the vulnerable WebGL component. Simply having the browser installed is not enough; the malicious code requires the user to load and interact with a page that exploits the memory error. Viewing safe, standard websites does not trigger this issue.

Is my system at risk from CVE-2026-79235?

According to Halo Surface Signal, this vulnerability is considered a likely risk because it affects a widely used browser designed to process untrusted content from the internet. Since the trigger involves visiting a webpage, any system using an affected version of Google Chrome that accesses the public internet is potentially susceptible to this remote attack vector.

How should I respond to this threat?

Begin by identifying all systems in your environment running versions of Google Chrome prior to 152.0.7977.65. Once identified, coordinate with your IT or end-user computing teams to verify which systems are business-critical or frequently used to access the internet. Finally, plan and implement the necessary browser updates to patch the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.