CVE-2026-78904: Critical Chrome ANGLE Type Confusion RCE — Public PoC Circulating, Patch Now
A critical type confusion in Chrome's ANGLE graphics layer (CVE-2026-78904) enables remote code execution outside the sandbox via a crafted HTML page. A public PoC is circulating and CISA has added it to KEV — patch to Chrome 152.0.7977.65 immediately.
TL;DR
CVE-2026-78904 is a critical type confusion vulnerability in ANGLE, the graphics translation layer inside Google Chrome. A remote attacker can execute arbitrary code outside the browser sandbox by convincing a user to open a crafted HTML page. Google fixed the flaw in Chrome 152.0.7977.65 (Windows/macOS) and 152.0.7977.64 (Linux).
- Severity: CVSS 3.1 base score 9.6 (Critical), scope changed.
- Exploitation status: CISA added CVE-2026-78904 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-25, indicating confirmed in-the-wild exploitation.
- Public PoC: A public proof-of-concept repository is circulating on GitHub, lowering the barrier for opportunistic attackers.
- Action: Patch Chrome to 152.0.7977.65 or later on every managed endpoint. Validate exposure, hunt for post-exploitation behavior, and treat unpatched browsers as compromised-capable.
If you run Chrome or a Chromium-based browser in your environment, this is a same-day priority. The combination of remote code execution, a public PoC, and KEV listing is the highest-urgency profile we track.
What Is CVE-2026-78904?
CVE-2026-78904 is a type confusion vulnerability in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate OpenGL ES calls into platform-native graphics APIs such as Direct3D on Windows, Metal on macOS, and Vulkan on Linux. The flaw allows a remote attacker to potentially execute arbitrary code outside the Chrome sandbox via a crafted HTML page. Chromium rated the underlying issue as High severity, and the CVSS 3.1 vector yields a 9.6 Critical score.
The vulnerability was reported to Google on 2026-07-22 and publicly disclosed on 2026-08-25 as part of the Chrome 152 stable channel release. The Chromium issue tracker references bug ID 537835609. The CWE classification is CWE-843 (Access of Resource Using Incompatible Type — 'Type Confusion').
In practical terms, this is a browser sandbox escape. The attacker does not need credentials, does not need to install anything on the victim's machine, and does not need to be on the same network. They need the victim to load a web page. That is the entire precondition.
Why This Vulnerability Matters Right Now
Three factors combine to make CVE-2026-78904 an urgent, board-visible item:
- Remote code execution outside the sandbox. The CVSS scope is 'Changed,' meaning impact extends beyond the browser process to the underlying operating system. Confidentiality, integrity, and availability are all rated High. A successful exploit is a full compromise of the user context running Chrome.
- Public proof-of-concept. A public PoC repository (referenced in Watchstack intelligence) is circulating. Public exploit code converts a theoretical bug into a practical tool that script kiddies, initial access brokers, and ransomware affiliates can pick up and modify.
- CISA KEV listing. CISA added CVE-2026-78904 to KEV on 2026-08-25. KEV listing is not a prediction; it is a statement that exploitation has been observed. Federal agencies and regulated organizations have mandated remediation timelines triggered by this listing.
The EPSS score for this CVE is currently low (0.00475, ~40th percentile). Do not let that mislead you. EPSS is a probabilistic model that lags behind confirmed exploitation and public tooling. When a CVE is on KEV with a public PoC, the KEV listing and the PoC are the authoritative signals. Prioritize accordingly.
Technical Details: How the ANGLE Type Confusion Works
ANGLE sits between Chrome's WebGL/WebGPU rendering pipeline and the host GPU driver stack. It is a cross-platform abstraction layer, which means it handles a large volume of untrusted input from web content and translates it into native graphics calls. That position makes it a high-value target: it is reachable from the web, it processes attacker-controlled data, and it operates near the boundary between the renderer sandbox and the GPU process.
A type confusion occurs when code processes an object as one type while it was allocated or initialized as another. In memory-unsafe languages like C++, this typically leads to out-of-bounds reads or writes, vtable corruption, or arbitrary pointer manipulation. In ANGLE's case, the confusion arises within the rendering pipeline when malformed graphics data is processed. The result is memory corruption inside the renderer process.
Because ANGLE interacts with GPU process boundaries and the renderer sandbox, a successful confusion can be leveraged to escape the renderer sandbox and execute code in a more privileged context. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) tells the story: network-reachable, low complexity, no privileges required, user interaction required (the victim must load the page), scope changed, and high impact across confidentiality, integrity, and availability.
The vulnerable range is Chrome prior to 152.0.7977.65 on Windows, macOS, and Linux. Chromium-based browsers that consume the same ANGLE code (Microsoft Edge, Brave, Opera, Vivaldi, and others) are exposed until their vendors ship the corresponding update.
Exposure Validation: Do You Actually Have This Bug in Your Fleet?
Before you assume patching is enough, validate exposure. Browser fleets drift. Users defer updates. Some endpoints are offline for weeks. Some are pinned to older versions by application compatibility requirements. Here is how to validate exposure systematically:
- Inventory Chrome versions across all endpoints. Use your endpoint management platform (Intune, Jamf, Workspace ONE, Tanium, etc.) to query the installed version of chrome.exe, Google Chrome.app, or the Linux package. Flag anything below 152.0.7977.65 (Windows/macOS) or 152.0.7977.64 (Linux).
- Include Chromium-based browsers. Edge, Brave, Opera, and Vivaldi may lag behind Chrome's release cadence. Check each vendor's advisory and version.
- Check for update deferral policies. Group Policy, MDM profiles, and enterprise update policies can block or delay Chrome updates. Confirm that your policies allow the 152.0.7977.65 build to install.
- Identify high-risk user populations. Executives, finance, HR, IT administrators, and anyone with access to sensitive SaaS consoles or email should be prioritized for verification.
- Look at your attack surface. If your users browse the open internet, click links in email, or view third-party ads, they are exposed. Browser isolation, if deployed, reduces but does not eliminate risk.
- Confirm the fix is actually applied. A successful update check is not the same as a confirmed version. Re-query after the update window and verify the version string.
If you cannot patch immediately, document the compensating controls in place (browser isolation, restricted browsing, WebGL disabled) and set a hard deadline. 'We will get to it next quarter' is not an acceptable answer for a KEV-listed RCE with a public PoC.
Detection and Hunting Guidance
Detection for CVE-2026-78904 has two layers: exploit attempt detection and post-exploitation detection. Because the exploit is delivered via a web page, network detection is difficult unless you have full TLS inspection and known-bad indicators. Endpoint detection is where you will get the most value.
Process-level indicators:
- Chrome renderer or GPU child processes spawning unexpected executables or scripts (cmd.exe, powershell.exe, bash, curl, python, wscript.exe, mshta.exe).
- Chrome processes with unusual parent-child relationships, especially where Chrome is the parent of a scripting interpreter.
- Process injection, token manipulation, or sandbox escape behavior originating from chrome.exe, as flagged by EDR.
Network-level indicators:
- Outbound connections from browser processes to unfamiliar or low-reputation hosts.
- DNS queries originating from the Chrome process to domains that do not match normal browsing patterns.
- Proxy logs showing access to known exploit-hosting domains or the public PoC repository referenced in intelligence.
File system and persistence indicators:
- New or modified files in user profile directories, startup folders, or temporary paths shortly after browsing activity.
- Scheduled tasks or startup entries created by or attributable to the browser process.
- Scripts or executables dropped in temp directories with names suggesting persistence, lateral movement, or credential dumping.
Log and telemetry indicators:
- Windows Event Logs showing unusual process creation events with Chrome as the parent process.
- PowerShell execution logs showing encoded or obfuscated commands initiated from a browser context.
- Crash reports referencing ANGLE, WebGL, or GPU process failures clustered around user browsing activity.
- Unusual authentication events or session token reuse following a suspected browser compromise.
Fleet hygiene indicator:
- Endpoint telemetry showing Chrome versions below 152.0.7977.65 in the environment. This is not an exploit indicator, but it is the exposure indicator that tells you where to focus.
If you detect any of the post-exploitation indicators above, treat the endpoint as compromised. Isolate it, preserve volatile evidence, and rotate credentials used in the browser session.
Indicators of Compromise
- Chrome renderer or GPU child processes spawning unexpected executables or scripts.
- Outbound network connections from browser processes to unfamiliar or low-reputation hosts.
- Crash reports referencing ANGLE, WebGL, or GPU process failures clustered around user browsing activity.
- New or modified files in user profile directories, startup folders, or temporary paths shortly after browsing.
- EDR alerts for process injection, token manipulation, or sandbox escape behavior originating from chrome.exe.
- Proxy or DNS logs showing access to known exploit-hosting domains or the public PoC repository referenced in intelligence.
- Unusual authentication events or session token reuse following a suspected browser compromise.
- Endpoint telemetry showing Chrome versions below 152.0.7977.65 in the environment.
Mitigation and Workarounds
Primary mitigation: patch. Upgrade Google Chrome to 152.0.7977.65 or later on Windows and macOS, and 152.0.7977.64 or later on Linux. Use Chrome's built-in update mechanism or download from the official Google Chrome website. For Chromium-based browsers, apply the equivalent vendor update once available. Microsoft has issued guidance for Edge (Chromium-based) users via the MSRC advisory. OpenSUSE and FreeBSD have released updated Chromium packages for their respective platforms.
Enable and enforce automatic updates. Verify that update policies are not blocking the 152.0.7977.65 build. Re-query endpoint management after the update window to confirm version compliance.
If immediate patching is not possible:
- Restrict access to untrusted or unknown websites.
- Consider deploying browser isolation solutions for high-risk browsing.
- Disabling WebGL or GPU acceleration may reduce exposure but can break business applications. Test before broad rollout.
- Apply network controls to block known exploit-hosting domains and monitor for public PoC indicators.
- Because CISA KEV lists this vulnerability, federal and regulated organizations should follow their mandated remediation timelines.
Post-patch validation. Confirm Chrome version 152.0.7977.65 or later on all managed endpoints. Do not assume the update applied because the update check succeeded. Verify the version string.
Community Reactions and Industry Context
The Chrome 152 release was notable for including 327 security fixes in a single update, which drew attention from security media outlets. Italian tech outlet Telefonino.net also covered the update, urging users to patch before browsing. The vulnerability was tracked and flagged by multiple security vendors including Tenable (Nessus plugins 339805, 342590, 342658, 342789) and Qualys, indicating broad industry awareness and detection coverage.
Security media and vulnerability tracking services have highlighted CVE-2026-78904 as a critical, actively exploited Chrome flaw. The presence of a public PoC on GitHub has amplified discussion among researchers and defenders, who note that browser sandbox escapes are high-value targets for both ransomware operators and espionage groups. CISA's KEV addition on 2026-08-25 signals that exploitation has been observed, and community guidance has focused on rapid patching and detection of post-exploitation behavior.
Some analysts have pointed out that the EPSS score is currently low (0.00475), which can create a false sense of safety. The KEV listing and public PoC outweigh the probabilistic score for prioritization. Overall, the community consensus is to treat this as an urgent patch-and-hunt item.
Trusteed Take: CTEM Prioritization for CVE-2026-78904
From a Continuous Threat Exposure Management (CTEM) perspective, CVE-2026-78904 is a textbook 'patch now' item. It combines remote reachability, low attack complexity, no privilege requirement, a scope change that enables host-level impact, confirmed exploitation (KEV), and public tooling (PoC). Any one of those factors would justify attention; together they justify immediate action.
The CTEM workflow for this CVE looks like this:
- Discover: Inventory Chrome and Chromium-based browser versions across all endpoints, including remote and BYOD devices where possible.
- Prioritize: Treat KEV-listed, PoC-backed RCE as top-tier. Do not deprioritize based on EPSS alone.
- Validate: Confirm exposure by version, not by assumption. Identify high-risk user populations and unmanaged endpoints.
- Mobilize: Push the patch, enforce update policies, and verify version compliance.
- Hunt: Deploy the detection guidance above to identify any pre-patch exploitation activity.
- Communicate: Brief leadership on exposure, remediation status, and residual risk.
If you cannot patch every endpoint today, patch the ones that matter most: executives, administrators, finance, and anyone with access to sensitive data or critical SaaS consoles. Then work outward until the fleet is clean.
Frequently Asked Questions
Is CVE-2026-78904 on CISA KEV?
Yes. CISA added CVE-2026-78904 to the Known Exploited Vulnerabilities catalog on 2026-08-25. That listing indicates confirmed in-the-wild exploitation and triggers mandated remediation timelines for federal agencies and many regulated organizations.
Is there a public PoC for CVE-2026-78904?
Yes. A public proof-of-concept repository is circulating on GitHub (referenced in Watchstack intelligence). Public PoC code lowers the barrier for opportunistic attackers and increases the likelihood of widespread exploitation attempts.
What is the CVSS score for CVE-2026-78904?
The CVSS 3.1 base score is 9.6 (Critical) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The scope change (S:C) reflects that impact extends beyond the browser sandbox to the underlying operating system.
What Chrome version fixes CVE-2026-78904?
Chrome 152.0.7977.65 (Windows and macOS) and 152.0.7977.64 (Linux). Any version prior to these is vulnerable.
Does this affect Microsoft Edge and other Chromium-based browsers?
Chromium-based browsers that consume the same ANGLE code are exposed until their vendors ship the corresponding update. Microsoft has issued guidance for Edge via the MSRC advisory. Check each vendor's advisory and version.
What is ANGLE and why does it matter?
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer. It translates OpenGL ES calls to platform-native APIs such as Direct3D, Metal, and Vulkan. Because it processes attacker-controlled web content and sits near the renderer sandbox boundary, it is a high-value target for exploitation.
Can I mitigate without patching?
You can reduce exposure by restricting untrusted web content, deploying browser isolation, or disabling WebGL/GPU acceleration (with testing, as this can break applications). These are compensating controls, not fixes. Patching is the only complete remediation.
What should I do if I suspect exploitation?
Isolate the endpoint, preserve volatile evidence, rotate credentials used in the browser session, and initiate incident response. Hunt for the indicators of compromise listed above, particularly unexpected child processes spawned by Chrome and outbound connections from browser processes.
Why is the EPSS score low if this is being exploited?
EPSS is a probabilistic model that can lag behind confirmed exploitation and public tooling. When a CVE is on KEV with a public PoC, those signals are authoritative. Do not deprioritize based on EPSS alone.
How quickly should I patch?
Immediately. For KEV-listed RCE with a public PoC, same-day patching is the standard. If you cannot patch everything today, prioritize high-risk users and exposed endpoints, then work outward until the fleet is clean.