CVE-2026-14382: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150

Synopsis

Insufficient input validation in ANGLE, the graphics abstraction layer used by Google Chrome, allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network without any authentication, though the victim must visit a malicious or attacker-controlled page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, enabling full compromise of the host process. A patched-image rebuild at Chrome 150.0.7871.46 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome process must be reachable in the sense that the user can browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit the attacker-controlled or compromised HTML page, making this a social-engineering or drive-by-browsing vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the victim loading the page.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser's host process, bypassing the primary isolation boundary.
• Full read access to data visible to the host process, including session tokens, credentials stored in the browser profile, and files accessible to the running user.
• Full write capability to data accessible by the host process, allowing modification or deletion of files, browser data, and configuration.
• The renderer and host process can be crashed or kept under attacker control, disrupting service for the affected user session.