CVE-2026-10019: Chrome ANGLE Integer Overflow Enables Cross-Origin Data Leak

Technical summary

CVE-2026-10019 is an integer overflow vulnerability (CWE-472) in ANGLE, Google's graphics abstraction layer for WebGL and hardware acceleration. When processing specially crafted rendering commands, inadequate bounds checking permits an integer to exceed its maximum value, causing memory allocation calculations to wrap around. This allows attackers to access heap memory regions containing data from cross-origin contexts, bypassing the same-origin policy that normally isolates websites from each other. The vulnerability requires user interaction—the victim must visit or be redirected to the attacker's webpage—but does not require elevated privileges or complex system configuration.

Business impact

Organizations face data exfiltration risk if employees browse untrusted websites while authenticated to sensitive web applications. Customer data, authentication tokens, proprietary information, and personal identifiable information could leak to attackers. Financial institutions, healthcare providers, law firms, and SaaS platforms hosting confidential data are at elevated risk. Incident response costs, regulatory notification obligations (GDPR, HIPAA, state privacy laws), and reputational damage compound the business impact. Additionally, widespread use of Chrome in enterprise environments means the attack surface is large.

Affected systems

Google Chrome versions prior to 148.0.7778.216 on Windows, macOS, and Linux systems are vulnerable. Chrome on mobile platforms (Android, iOS) running the same or earlier versions should also be assessed. The vulnerability does not affect other Chromium-based browsers unless they bundle the vulnerable ANGLE version; however, Edge, Opera, and Brave users should verify patch status. The vulnerability is not a kernel or OS-level issue, so patches to Windows, macOS, or Linux kernel alone will not mitigate it—Chrome must be updated specifically.

Exploitability

Exploitation requires moderate attacker sophistication. The attacker must craft a malicious HTML page with WebGL or graphics operations that trigger the integer overflow, then convince or redirect a user to that page. No authentication or special system access is required. The user merely needs to visit the compromised site while authenticated to another service; they do not need to click further or disable security settings. The CVSS score of 8.8 reflects the high attack surface (network-accessible), low barrier to entry (no authentication), and high impact (confidentiality and integrity). The vulnerability is not currently in active public exploit or the CISA KEV catalog, but the attack is well within the capability of nation-state and sophisticated cybercriminal groups.

Remediation

Immediately update Google Chrome to version 148.0.7778.216 or later. Chrome automatically downloads updates but may require a browser restart to apply them; users can verify the installed version in Chrome's about menu. For organizations, deploy Chrome updates via ADMX policies (Windows) or MDM profiles (macOS, mobile) to enforce uniformity. Disable or restrict access to untrusted websites through network policies if possible, though this is not a substitute for patching. Users on unsupported OS versions (e.g., Windows 7, very old macOS) should upgrade their operating system or consider alternative browsers if Chrome updates are unavailable.

Patch guidance

Verify your installed Chrome version by navigating to chrome://settings/help, which displays the current version and initiates an auto-update if available. Version 148.0.7778.216 or any subsequent 148+ release addresses this vulnerability. After updating, restart the browser to ensure the new code is loaded. For enterprise deployment, refer to Google's official Chrome Enterprise release notes and ADMX templates to confirm version 148.0.7778.216 availability in your managed environment. Test patches in a pilot group before organization-wide rollout. Mobile users should update Chrome through their platform's app store; auto-update settings can be enabled to streamline future patches.

Detection guidance

Endpoint detection and response (EDR) solutions can monitor for abnormal WebGL or graphics API calls, though signature-based detection is difficult without Chrome's internal instrumentation. Log browser crashes or WebGL context losses, which may indicate exploitation attempts. Network-based detection is impractical for this vulnerability, as the exploit traffic is encrypted HTTPS between the user and the attacker's site. Focus instead on ensuring rapid patch deployment and monitoring for anomalous data exfiltration (outbound connections from browsers containing sensitive data). Gather Chrome version inventory across endpoints to identify stragglers. If breach suspected, examine browser cache, history, and session data for evidence of visits to suspicious domains during the window of vulnerability exposure.

Why prioritize this

Although classified as Medium severity by Chromium, the CVSS score of 8.8 reflects High risk due to full confidentiality compromise, potential integrity impact, and user-level availability disruption. The lack of KEV status does not diminish urgency—the vulnerability affects billions of Chrome users and has straightforward exploitation requirements. Cross-origin data leakage can compromise entire organizations if employees are targeted. Patch availability is immediate and non-disruptive, making remediation low-cost. Prioritize this for patching within 48–72 hours, particularly for roles with access to sensitive systems.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: (1) Attack Vector Network—the malicious page is served over the internet to any Chrome user; (2) Attack Complexity Low—no special conditions beyond crafting a webpage; (3) Privileges Required None—no authentication or elevation needed; (4) User Interaction Required—the user must visit the page, but this is easily achieved via phishing or compromised ads; (5) Scope Unchanged—the impact is confined to the user's browser session; (6) Confidentiality High—cross-origin data is fully readable; (7) Integrity High—attackers can inject or modify data within the browser context; (8) Availability High—a malicious page could crash or render the browser unresponsive. The gap between Chromium's 'Medium' rating and the CVSS 8.8 likely reflects Google's conservative risk model; the CVSS vector more accurately captures the practical threat.

Frequently asked questions