CVE-2026-10913: Use after free in ANGLE in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in ANGLE, the graphics translation layer used by Google Chrome on Windows, allows a remote attacker to execute arbitrary code inside Chrome's sandbox by luring a user to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only that the target visits a malicious page. Successful exploitation gives the attacker code execution within the renderer sandbox, which can serve as a stepping stone toward a full browser or system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable to normal web traffic.

• AuthenticationNot required

  No account, credential, or session token of any kind is needed to trigger the vulnerability.

• Victim interactionRequired

  The target user must visit a crafted HTML page, making this a social-engineering-dependent attack that requires the victim to click a link or be redirected.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, specific memory layout, or environmental configuration is required to trigger the use-after-free.

Blast Radius

• The attacker executes arbitrary code inside Chrome's renderer sandbox on the victim's Windows machine.
• Confidential data accessible to the renderer process, including page content, stored credentials surfaced by autofill, and session tokens, can be read.
• The attacker can modify page content and intercept or tamper with data the user submits through the browser.
• Renderer process stability is fully compromised, and the foothold can be used as a launch point for a sandbox-escape chain targeting the underlying OS.