CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150

Synopsis

Insufficient input validation in ANGLE, the graphics abstraction layer embedded in Google Chrome, allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network and requires no authentication, though it does require a user to interact with a malicious page. Successful exploitation gives the attacker full read, write, and availability impact on the host, breaking out of the containment boundary that normally limits browser-based compromise. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page, so the affected service must be reachable from an external or network-adjacent position.

• AuthenticationNot required

  No account or credential is needed; any anonymous visitor to a malicious page can trigger the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making social engineering or a malicious ad/link a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other unpredictable environmental factors beyond a prior renderer compromise.

Blast Radius

• Attacker escapes the Chrome sandbox and gains code execution in the context of the browser process on the host operating system.
• Reads files, credentials, and session data accessible to the user running Chrome, including stored passwords and authentication tokens.
• Writes or modifies files on the host filesystem, enabling persistence mechanisms or tampering with local data.
• Crashes or destabilizes the browser and potentially host-level services, causing service disruption beyond the browser sandbox.