CVE-2026-14390: Use after free in ANGLE in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in ANGLE, the graphics translation layer inside Google Chrome, affects all Chrome versions prior to 150.0.7871.46. The flaw is reachable over the network without any account or credentials, but requires the victim to visit a crafted HTML page. Successful exploitation gives a remote attacker full read, write, and availability impact across the browser process and breaks out of Chrome's sandbox, enabling code execution on the underlying host. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page; the target Chrome instance must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account, session token, or credentials of any kind are needed; the attacker is anonymous.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, memory layout luck, or other environmental factors.

Blast Radius

• A successful attacker reads sensitive data from the browser process, including stored credentials, session tokens, and page content from any open origin.
• The attacker modifies browser memory and persisted browser state, including cookies, cached data, and extension storage.
• The sandbox escape gives the attacker code execution in the context of the Chrome renderer and then the host OS process, bypassing Chrome's primary isolation boundary.
• The attacker can crash or render the affected browser instance unavailable, disrupting the end user's session and any dependent services.