CVE-2026-11191: Out of bounds memory access in ANGLE in Google Chrome prior to 149

Synopsis

Out-of-bounds memory access in the ANGLE graphics layer of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to read or write outside allocated memory by serving a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to visit a malicious or compromised page. Successful exploitation gives the attacker full read, write, and crash capabilities over the affected browser process. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim over the network by delivering or linking to a crafted HTML page served from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attacker exploits an unauthenticated browser rendering path.

• Victim interactionRequired

  The victim must open or navigate to the attacker-controlled HTML page, requiring a social-engineering or malicious-ad delivery step.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim loads the page; no race conditions or special memory layout is required.

Blast Radius

• Reads arbitrary memory from the Chrome renderer process, exposing stored credentials, session tokens, and page content from other origins.
• Writes to out-of-bounds memory regions, allowing the attacker to corrupt renderer state or overwrite security-sensitive data structures.
• Crashes the affected Chrome renderer process, causing loss of the active browsing session and any unsaved in-page data.
• Combined high-confidence read, write, and crash capability makes this a strong primitive for chaining toward a full browser sandbox escape.