CVE-2026-10883: Type Confusion in ANGLE in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker to trigger heap corruption by directing a victim to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit an attacker-controlled page. Successful exploitation gives the attacker full read, write, and crash capability over the renderer process, which in practice enables remote code execution. A patched-image rebuild at Chrome 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page to the victim over the network, so the Chrome instance must be reachable by the user via a standard internet or intranet connection.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can host the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• Reads arbitrary memory within the Chrome renderer process, exposing session tokens, credentials, and page content from open tabs.
• Writes to heap memory, enabling the attacker to corrupt renderer state and pivot toward code execution within the sandboxed process.
• Crashes the renderer process, causing denial of service for the affected tab or the entire browser depending on sandbox escape success.
• If combined with a sandbox escape, gives the attacker full code execution as the OS user running Chrome.