CVE-2026-10881: Out of bounds read and write in ANGLE in Google Chrome prior to 149

Synopsis

An out-of-bounds read and write vulnerability exists in ANGLE, the graphics abstraction layer embedded in Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a victim to visit or be redirected to a crafted HTML page. Successful exploitation enables a full sandbox escape, giving an attacker arbitrary code execution outside the Chrome renderer sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by delivering or luring the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential of any kind is needed to serve the malicious page and trigger the vulnerability.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the victim loads the page; no race condition, special memory layout, or environmental prerequisite is required.

Blast Radius

• A successful exploit escapes the Chrome renderer sandbox, giving the attacker code execution in the context of the browser process on the victim host.
• With sandbox escape achieved, the attacker reads arbitrary files accessible to the browser process, including stored credentials, session cookies, and user profile data.
• The attacker writes or modifies files on the host filesystem and can persist malicious code or tamper with locally stored application data.
• The attacker can crash or destabilize the browser process and any dependent services, causing denial of service on the affected host.