CVE-2026-11061: Type Confusion in ANGLE in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in ANGLE (Chrome's OpenGL ES translation layer) affects Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page. Successful exploitation allows a remote attacker to escape Chrome's renderer sandbox, gaining the ability to read data, modify files, and disrupt services outside the browser's normal containment boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must open a crafted HTML page in a vulnerable Chrome instance, meaning the attacker must socially engineer or redirect a user to that page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or non-default configuration.

Blast Radius

• Attacker escapes Chrome's renderer sandbox, gaining code execution in a more privileged process context outside normal browser containment.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files, becomes readable to the attacker.
• The attacker can write or modify files and data on the host system within the reach of the compromised process.
• The compromised process can be used to crash or destabilize affected services, causing denial of service to the host environment.