CVE-2026-11040: Use after free in ANGLE in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in ANGLE, the graphics translation layer used by Google Chrome, affects all Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network, requires no authentication, but does require the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation allows a full sandbox escape, giving the attacker code execution outside the browser sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable and browsing to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attack is initiated through a publicly accessible crafted web page.

• Victim interactionRequired

  The target user must visit the crafted HTML page, requiring a social-engineering step to direct them to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is high; the attacker must first compromise the renderer process before this use-after-free can be used for sandbox escape, introducing significant prerequisite steps.

Blast Radius

• An attacker who completes the sandbox escape gains the ability to read files, credentials, and session data accessible to the browser process on the host.
• The attacker can write or modify files and data on the host, including persisted application state outside the browser sandbox.
• The attacker can crash or destabilize the browser or dependent host services, causing a denial of service.
• Because the sandbox boundary is fully bypassed, further lateral movement or privilege escalation on the host system becomes possible.