CVE-2026-13859: Inappropriate implementation in ANGLE in Google Chrome prior to 150

Synopsis

An inappropriate implementation flaw in the ANGLE graphics layer of Google Chrome before version 150.0.7871.47 allows a remote attacker to trigger a sandbox escape. The vulnerability is reachable over the network without authentication, but requires the victim to visit a crafted HTML page. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the browser sandbox, effectively enabling code execution in the context of the host process. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No authentication or account credentials are needed; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector that requires at least one user action such as clicking a link or being redirected.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside the Chrome renderer sandbox, in the context of the browser process on the host.
• The attacker reads any data accessible to the browser process, including stored credentials, session tokens, and local profile data.
• The attacker can write or modify files and persistent data accessible to the browser process on the host system.
• The attacker can crash or destabilize the browser process and any dependent services, causing denial of service for the affected user session.