AES-GCM: Verification before Decryption I am looking at ChaCha20Poly1305 WolfSSL. It is noted that the ChaCha20Poly1305 AEAD construction has the property, that it only outputs the plaintext, if the verification of the MAC (Authentication Tag) was successful.
I am asking myself whether AES-GCM also can provide this (from a security perspective quite important) property. However, when looking at the mode diagram of GCM, it seems like the Authentication Tag is calculated successively using information from each ciphertext block. Therefore, the cipher must be decrypted in order to verify its integrity?
Therefore, the cipher must be decrypted in order to verify its integrity?

No, there is no such requirement.  As you state, the authentication tag is calculated from the ciphertext blocks, however, the receiver does not have to decrypt anything to get the value of the ciphertext blocks - he gets those directly.
One of the things that appear to be confusing you is that the diagram is the processing that occurs during encryption, not decryption.
For GCM decryption, the authentication block is validated this way: he takes the ciphertext (and the AAD), and repeatedly does MULTH and ADD [1] operations, then he MULTH and ADDs the AAD/ciphertext len, and then a MULTH and ADD of the processed nonce.  No decryption of ciphertext need to be done.
[1]: I say &quot;ADD&quot; even though it is really XOR; we're working in $GF(2^{128})$, and so field addition is xor.