CVE-2026-10919: Use after free in ANGLE in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer embedded in Google Chrome versions prior to 149.0.7827.53, allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox by delivering a crafted HTML page. The flaw is reachable over the network and requires the victim to interact with attacker-controlled content, though no authentication is needed. Successful exploitation gives the attacker full read, write, and availability impact outside the renderer sandbox, effectively breaking Chrome's primary containment layer. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable or the user must browse to an attacker-controlled origin.

• AuthenticationNot required

  No account credentials or prior session are needed; the attacker only requires the ability to serve content to the victim's browser.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making a social-engineering or malicious-link delivery step necessary before the exploit can trigger.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must have already compromised the renderer process as a prerequisite, which introduces an additional exploit stage before the sandbox escape can succeed.

Blast Radius

• Reads sensitive data from outside the renderer sandbox, including stored credentials, cookies, and files accessible to the browser process.
• Modifies data or injects code in the context of the browser process, bypassing Chrome's sandbox isolation.
• Crashes or destabilizes the browser process, causing a denial of service for the affected session.
• Gains arbitrary code execution at the privilege level of the Chrome browser process, enabling further lateral movement on the host.