CVE-2026-11055: Use after free in ANGLE in Google Chrome on Windows prior to 149

Synopsis

A use-after-free vulnerability exists in ANGLE, the graphics-translation layer used by Google Chrome on Windows, in versions prior to 149.0.7827.53. The flaw is reachable over the network with no prior authentication, but requires a user to visit a crafted HTML page. Successful exploitation allows a remote attacker to execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the targeted Chrome instance must be reachable in the sense that the user can browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote attacker who can serve a crafted HTML page can attempt exploitation.

• Victim interactionRequired

  The victim must navigate to or open a crafted HTML page, making this a social-engineering vector that requires a user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the Chrome renderer process, gaining code execution inside the sandbox.
• Confidential data accessible to the renderer, such as page contents, stored credentials surfaced by autofill, and session tokens, can be read.
• The attacker can tamper with page data and browser state, including modifying rendered content or injecting further malicious scripts.
• The renderer process can be crashed or destabilized, disrupting the browsing session for the affected user.