CVE-2026-10955: Type Confusion in ANGLE in Google Chrome on Windows prior to 149

Synopsis

A type confusion vulnerability in ANGLE, the graphics translation layer used by Google Chrome on Windows, allows a remote attacker to trigger out-of-bounds memory access by serving a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit a malicious page in an affected browser. Successful exploitation gives the attacker read, write, and crash primitives over the browser process, enabling data theft, content tampering, or denial of service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must serve a crafted HTML page to the victim over the network, so the Chrome process must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker who can deliver a link or embed content can trigger the vulnerability.

• Victim interactionRequired

  The victim must open or be redirected to the attacker-crafted HTML page in an affected Chrome instance, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental precondition beyond the victim visiting the page.

Blast Radius

• Reads arbitrary memory from the Chrome renderer process, exposing stored credentials, session tokens, and page content from other open tabs.
• Writes to out-of-bounds memory regions, allowing the attacker to corrupt browser state or inject data into the running process.
• Crashes the affected Chrome process, denying browser availability to the victim for the duration of exploitation or as a side effect of a failed payload.
• Combined high confidentiality, integrity, and availability impact means a reliable exploit can chain these primitives toward full renderer compromise.