External risk intelligence

Chrome ANGLE Use After Free Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79282

This vulnerability exists in the browser's client-side rendering engine (ANGLE). Exploitation requires a user to interact with a crafted HTML page within the browser application. It is a client-side attack surface rather than an internet-facing service, gateway, or externally reachable infrastructure component.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in ANGLE, a component within Google Chrome on Android, has been identified, potentially allowing attackers to execute malicious code outside the browser's secure sandbox. This issue could arise from visiting a specially crafted webpage. The primary concern at this stage is to determine if our systems are affected by this type of exposure.

Code execution flaw in browser rendering.
Affects user interaction with web pages.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could lure a user to a malicious website that exploits a flaw in how Chrome on Android handles certain web content. This could allow the attacker to run their own code on the user's device, potentially impacting other applications.

Requires visiting a malicious website.
Triggered by viewing crafted HTML.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in ANGLE, a graphics engine used by Google Chrome on Android, could allow a remote attacker to execute arbitrary code outside the browser's sandbox when a user visits a specially crafted HTML page. This could potentially impact the integrity and confidentiality of the user's device.

User-provided web content could be affected.
Visiting a malicious HTML page could trigger it.
Arbitrary code execution outside the sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

The use-after-free vulnerability in ANGLE within Google Chrome on Android requires user interaction with a malicious HTML page to exploit. The first practical step is to identify where the affected browser version is deployed, confirm its reachability and criticality, and then plan remediation by coordinating with the vendor for updates.

Browser and mobile application owners own this issue.
Verify user exposure to crafted HTML pages.
Coordinate vendor updates and plan remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a graphics abstraction layer used by Chrome on Android. It translates standard graphics commands into the specific language required by a device's GPU, helping the browser efficiently render web content, animations, and complex visual elements.

What does a use-after-free vulnerability mean in CVE-2026-79282?

This is a memory management flaw classified as CWE-416. It occurs when a program continues to use a pointer to a memory location after that memory has been cleared or freed. In this CVE, an attacker can manipulate this state to trick the browser into executing arbitrary code.

How is this vulnerability triggered?

An attacker triggers this by luring a user to visit a specially crafted HTML page. Simply having the browser installed is not enough; the malicious code must be processed while the user views the page. Standard, benign web browsing does not trigger this error.

Is this vulnerability considered internet-facing?

According to Halo Surface Signal, this is not an internet-facing service or infrastructure component. Because it resides in the browser's client-side rendering engine, it acts as a client-side attack surface that requires specific user interaction to become a risk.

Do I need to update my software to fix this?

Yes. Since this is a critical browser vulnerability, the primary response is to ensure your version of Google Chrome on Android is updated to at least 152.0.7977.65. Check your device's app store settings to verify you are running the latest version provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.