CVE-2026-11088: Integer overflow in ANGLE in Google Chrome prior to 149

Synopsis

An integer overflow vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The CVSS vector indicates the attack is reachable over the network, requires no authentication, but does require the victim to visit a malicious page, and carries critical severity at 9.6. Successful exploitation gives the attacker full read, write, and crash capabilities outside the sandbox, effectively breaking the browser's primary containment boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on a remote origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user browsing to the malicious page can be targeted.

• Victim interactionRequired

  The victim must open or be redirected to the attacker-controlled HTML page, making social engineering or malicious ad delivery the primary delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors beyond a successful prior renderer compromise.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox and executes arbitrary code in the context of the browser process on the victim host.
• With sandbox escape achieved, the attacker reads files, credentials, and session tokens accessible to the browser process user account.
• The attacker writes or modifies files on the host filesystem and can install persistent payloads outside the browser's sandboxed storage.
• The attacker can crash or destabilize the browser process and any dependent services running under the same user context.