CVE-2026-14152: Out of bounds read and write in ANGLE in Google Chrome prior to 150

Synopsis

An out-of-bounds read and write vulnerability exists in ANGLE, the graphics abstraction layer used by Google Chrome prior to version 150.0.7871.47. The flaw is reachable over the network without authentication, but requires a user to visit a crafted HTML page and assumes the attacker has already compromised the renderer process. Successful exploitation enables a sandbox escape, giving the attacker code execution outside Chrome's renderer sandbox with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page, so the vulnerable service must be reachable from an external or network-adjacent origin.

• AuthenticationNot required

  No credentials or account are required; the attacker needs only to get a user to load a crafted page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on a social-engineering step such as a malicious link or redirect.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout, though it does assume the renderer process has already been compromised as a prerequisite.

Blast Radius

• Attacker escapes Chrome's renderer sandbox, gaining code execution in a more privileged process context on the host.
• High confidentiality impact: the attacker can read data outside the sandbox boundary, including files and memory accessible to the browser process.
• High integrity impact: the attacker can write to resources outside the sandbox, enabling modification of files or process memory on the host.
• High availability impact: the attacker can crash or disrupt the browser process and potentially other host processes reachable from the escaped context.