CVE-2026-11065: Use after free in ANGLE in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in ANGLE (the graphics abstraction layer) affects Google Chrome versions prior to 149.0.7827.53. The bug is reachable over the network without authentication, but requires the attacker to have already compromised the renderer process and to trick the victim into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code-execution capabilities outside the Chrome sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials are needed; the attacker interacts with the browser as an anonymous remote party.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must use a phishing or drive-by delivery method to lure the target.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the prerequisite renderer compromise.

Blast Radius

• The attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host.
• With code execution outside the sandbox, the attacker reads files, stored credentials, and session data accessible to the browser process.
• The attacker modifies or deletes files and browser-stored data within the reach of the compromised process.
• The attacker can crash or destabilize the browser process, disrupting availability for the affected user.