CVE-2026-11066: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149

Synopsis

Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine), the graphics translation layer bundled with Google Chrome, allows a remote attacker to escape the Chrome sandbox via a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but the victim must visit a malicious page. Successful exploitation gives the attacker full read, write, and crash capabilities outside the browser sandbox, effectively achieving remote code execution on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated visitor to the malicious page is a valid target.

• Victim interactionRequired

  The victim must open the crafted HTML page in an affected Chrome version, making this a social-engineering or drive-by-browsing scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout assumptions, or environmental dependencies.

Blast Radius

• Attacker breaks out of the Chrome renderer sandbox, gaining code execution in the context of the browser process on the host operating system.
• With sandbox escape achieved, the attacker can read files and credentials stored on the host, including session tokens, SSH keys, and locally cached secrets.
• The attacker can write or modify files on the host filesystem, enabling persistence mechanisms such as dropping malicious binaries or altering startup scripts.
• The attacker can crash or destabilize the host process, causing service disruption for the affected user or system.