CVE-2026-14425: Use after free in ANGLE in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in ANGLE, the graphics abstraction layer inside Google Chrome, affects all Chrome versions prior to 150.0.7871.46. The flaw is reachable over the network without authentication, but requires the victim to visit a crafted HTML page delivered by the attacker. Successful exploitation enables a full sandbox escape, giving the attacker read, write, and denial-of-service capability outside the Chrome renderer process. A patched-image rebuild at version 150.0.7871.46 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by browsing to an attacker-controlled or compromised web page.

• AuthenticationNot required

  No account, credential, or prior authentication to any service is needed; any unauthenticated user browsing the web can be targeted.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond victim interaction.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and executes code in a higher-privilege process context on the host.
• Confidential data accessible to the browser process (stored credentials, session tokens, locally cached files) becomes readable to the attacker.
• The attacker can write or modify data in process memory and on disk outside the sandbox boundary.
• The attacker can crash Chrome or deny service to the affected session and any dependent browser-based workloads.