CVE-2026-10907: Out of bounds write in ANGLE in Google Chrome prior to 149

Synopsis

An out-of-bounds write vulnerability in ANGLE, the graphics translation layer embedded in Google Chrome, affects all Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must visit a crafted HTML page that triggers the heap corruption. Successful exploitation gives an attacker full read, write, and crash capability over the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on a remote server.

• AuthenticationNot required

  No account or credential of any kind is needed on the targeted system; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must open a specially crafted HTML page, meaning the attacker must rely on phishing, malvertising, or a similar social-engineering vector to achieve code execution.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker achieves arbitrary read access inside the Chrome browser process, exposing stored session tokens, saved credentials, and in-memory page content.
• The out-of-bounds write primitive allows the attacker to overwrite heap memory, enabling arbitrary code execution within the Chrome sandbox at the privilege level of the renderer process.
• An attacker can crash the browser process entirely, causing immediate denial of service for the affected user session.
• If paired with a sandbox escape, the foothold in the renderer can be used as a stepping stone to write files or execute code at the operating-system level.