CVE-2026-11111: Out of bounds read in ANGLE in Google Chrome prior to 149

Synopsis

An out-of-bounds read vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network without authentication, but requires a user to visit a crafted HTML page. Successful exploitation reads memory outside intended bounds, disclosing sensitive in-process data and crashing the affected renderer. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted Chrome instance must be reachable or browsing to attacker-controlled content over the internet or an internal network.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The targeted user must visit the attacker-crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Reads memory outside the intended buffer inside the Chrome renderer process, potentially exposing in-process data such as decoded image content, DOM data, or other renderer-resident values.
• Causes a high-severity availability impact, crashing the affected renderer or tab and disrupting the user's session.
• No write or modification capability is indicated by the CVSS vector, so database rows, files, and persisted state are not directly tampered with by this exploit.