CVE-2026-11043: Out of bounds write in ANGLE in Google Chrome on Mac prior to 149

Synopsis

Out-of-bounds write vulnerability in ANGLE (the graphics abstraction layer) within Google Chrome on macOS, affecting all versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require a victim to interact with a crafted HTML page; it also requires the attacker to have already compromised the Chrome renderer process. Successful exploitation allows a full sandbox escape, giving the attacker code execution outside the browser sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted service or user must be reachable from an internet or network-adjacent origin.

• AuthenticationNot required

  No account credentials or prior authentication are needed to serve the malicious page to a victim.

• Victim interactionRequired

  A victim must navigate to or otherwise load the attacker-controlled HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  The exploit itself is condition-free and reliable once the renderer process is compromised, though gaining that renderer compromise is itself a prerequisite step that adds practical complexity.

Blast Radius

• Attacker escapes the Chrome sandbox on macOS, gaining code execution at the level of the browser process outside the sandbox boundary.
• With sandbox escape achieved, the attacker reads files, stored credentials, and session tokens accessible to the user running Chrome.
• The attacker writes or modifies files on the host filesystem, including persisted application data and configuration files.
• The attacker crashes or otherwise disrupts the browser process and any dependent services running under the same user account.