CVE-2026-10914: Use after free in ANGLE in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows, allows a remote attacker to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, and does trigger when a victim visits a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page, so the affected Chrome instance must be reachable to a browser session with outbound internet or intranet access.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated visitor to the malicious page can be targeted.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making social engineering or a malicious advertisement a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental preconditions beyond the victim visiting the page.

Blast Radius

• The attacker gains arbitrary code execution inside the Chrome renderer sandbox process on the victim's Windows host.
• Confidentiality impact is high: the attacker can read process memory accessible to the renderer, including cached credentials, session tokens, and page content.
• Integrity impact is high: the attacker can write to and manipulate data within the sandbox, and a sandbox escape chained to this bug would extend write access further.
• Availability impact is high: the renderer process can be crashed or held, disrupting the browser session on the affected host.