CVE-2026-10929: Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149

Synopsis

A heap buffer overflow vulnerability exists in ANGLE, the graphics translation layer used by Google Chrome on Android, in versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require the attacker to have already compromised the Chrome renderer process and to trick the victim into visiting a crafted HTML page. Successful exploitation allows the attacker to escape the browser sandbox, gaining elevated access beyond the sandboxed renderer with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making this an over-the-network exposure.

• AuthenticationNot required

  No authentication or account credentials are needed to initiate the attack against the target.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, requiring a social-engineering or phishing step.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must first have compromised the renderer process before leveraging this overflow, introducing a significant pre-condition.

Blast Radius

• Attacker escapes the Chrome sandbox, breaking out of the isolation boundary meant to contain compromised renderer code.
• Reads sensitive data accessible to the browser process, including stored credentials, session tokens, and page content from other origins.
• Modifies browser state, local storage, or data accessible at the elevated post-sandbox-escape privilege level.
• Crashes or destabilizes the browser process, causing denial of service to the affected user session.