CVE-2026-10889: Out of bounds read in ANGLE in Google Chrome prior to 149

Synopsis

An out-of-bounds read vulnerability exists in ANGLE, the graphics abstraction layer inside Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the attacker to have already compromised the Chrome renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation allows a full sandbox escape, giving the attacker code execution outside the browser's sandboxed process with high confidentiality, integrity, and availability impact. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched against an unauthenticated browsing session.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, requiring a social-engineering step.

• Attack complexityDetail

  Exploitation is high-complexity because it assumes the attacker has already achieved renderer-process compromise as a prerequisite before attempting the sandbox escape.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution in the context of the host process, reading files and credentials accessible to the browser process.
• The attacker can modify data on the host, including writing files or tampering with user-accessible storage outside the sandbox.
• The attacker can crash or destabilize host-level processes, disrupting services running under the same user account.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser itself to the underlying host environment.