CVE-2026-14411: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150

Synopsis

Insufficient input validation in ANGLE, the graphics translation layer inside Google Chrome, allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though a victim must visit a malicious page. Successful exploitation gives the attacker code execution outside the Chrome sandbox, effectively breaking the primary isolation boundary that prevents web content from accessing the host system. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a crafted HTML page, so the Chrome instance must be reachable through normal browser traffic.

• AuthenticationNot required

  No credentials or account are needed; any anonymous visitor to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must open the crafted HTML page in an affected Chrome browser, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Breaks out of the Chrome renderer sandbox, giving the attacker a foothold at the privilege level of the browser process on the host.
• Reads files and credentials accessible to the user running Chrome, including session tokens, saved passwords, and local configuration data.
• Writes or modifies files on the host filesystem within the user's permission scope, enabling persistence or tampering with local application data.
• Can crash or destabilize the browser process and any dependent services, causing denial of service for the affected user session.