CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149

Synopsis

This is an insufficient input validation vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome prior to version 149.0.7827.53. An attacker who has already compromised the Chrome renderer process can exploit this flaw remotely, without authentication, by luring a victim to a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with the privileges of the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, delivering the crafted HTML page through a browser-accessible URL.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can initiate the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering vector requiring at least one user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the pre-condition of renderer compromise.

Blast Radius

• An attacker escapes the Chrome renderer sandbox and executes arbitrary code with the privileges of the browser process on the victim host.
• With browser-level process access, the attacker can read files, credentials, and session data accessible to the browser user account.
• The attacker can write or modify files and persistent data within the browser user's permission scope.
• The attacker can crash or destabilize the browser process, disrupting service for the affected user.