CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149

Synopsis

Insufficient input validation in ANGLE (the graphics abstraction layer inside Google Chrome) allows a remote attacker to escape Chrome's sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a malicious page; it is rated Critical at CVSS 9.6. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact beyond the browser sandbox, effectively allowing arbitrary code execution on the host. A patched-image rebuild at Chrome 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the victim's browser fetches and renders the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated party who can serve a web page to the victim can attempt exploitation.

• Victim interactionRequired

  The victim must navigate to or be directed to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code with the privileges of the Chrome renderer process outside the sandbox, bypassing the primary browser security boundary.
• The attacker reads files, credentials, and session tokens accessible to the user running Chrome on the host.
• The attacker modifies or deletes files and data accessible to that user, including application state and configuration on the host.
• The attacker can crash or destabilize the host process or launch further payloads, disrupting service availability for the affected user.