CVE-2026-13883: Type Confusion in ANGLE in Google Chrome prior to 150

Synopsis

A type confusion vulnerability in ANGLE, the graphics translation layer inside Google Chrome, allows a remote attacker to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network and requires no authentication, though the victim must visit a malicious page. Successful exploitation gives the attacker code execution outside the browser sandbox, with full access to confidential data, the ability to modify system state, and the ability to crash or destabilize the affected host. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the service (the victim's browser session) must be reachable from the internet.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or load a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout tricks, or other environmental prerequisites.

Blast Radius

• Reads sensitive data from outside the browser sandbox, including files, credentials, and session material accessible to the browser process user.
• Modifies files and system state outside the browser sandbox, enabling persistent changes or secondary payload installation.
• Crashes or destabilizes the affected host process, causing service disruption beyond the browser tab.
• Because the scope is Changed in the CVSS vector, impact extends to components outside the vulnerable browser process itself.