CVE-2026-10914: Chrome ANGLE Use-After-Free RCE on Windows

Technical summary

CVE-2026-10914 is a use-after-free defect (CWE-416) in ANGLE, Google's cross-platform graphics rendering engine, specifically on Windows. Use-after-free flaws occur when code attempts to access memory that has already been freed, potentially allowing an attacker to read sensitive data, corrupt memory, or execute arbitrary instructions. In this case, the vulnerability resides in graphics processing logic and can be triggered via a specially crafted HTML page served to a Chrome user. The attack surface is the web rendering pipeline, making it accessible to any website an unsuspecting user visits. The vulnerability is contained within Chrome's sandbox, which isolates the rendering process from direct system access, though sandbox escapes remain a theoretical concern in advanced attack chains.

Business impact

This vulnerability poses a direct risk to any organization whose users browse the web using affected Chrome versions on Windows. Successful exploitation could lead to malware installation within the sandbox, credential theft from browser memory, session hijacking, or lateral movement preparation if chained with additional exploits. For enterprises, the risk is amplified in remote work scenarios where users operate on corporate networks. The requirement for user interaction (visiting a website) makes this a practical attack vector; adversaries have historically embedded such exploits in drive-by download campaigns, watering-hole attacks, or spear-phishing links. The HIGH severity rating reflects both the ease of exploitation and the potential for code execution.

Affected systems

Google Chrome on Windows versions prior to 149.0.7827.53 are affected. Microsoft Windows itself is listed as a vendor/product, reflecting the Windows-specific nature of the vulnerability; however, the flaw resides in Chrome's ANGLE rendering implementation rather than the OS itself. Chrome on other platforms (macOS, Linux, Android) is not affected by this particular ANGLE use-after-free. Users should verify their Chrome version; automatic updates are the default, but corporate deployments or devices with updates disabled may remain vulnerable.

Exploitability

This vulnerability has a low barrier to exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-based attack, low complexity, no privileges needed, but does require user interaction. An attacker needs only to host a malicious HTML page and convince or trick a user into accessing it—no advanced social engineering or zero-day exploitation techniques beyond the vulnerability itself are necessary. The use-after-free condition is deterministic enough to be reliably triggered in controlled testing, though heap spray and other memory layout techniques may be needed for reliable code execution. As of the data provided, this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning there is no evidence of active in-the-wild exploitation at the time of publication, but this does not preclude private exploitation or future abuse.

Remediation

The immediate remediation is to update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism should deliver this patch automatically within days of the user's next browser session; however, administrators managing Chrome deployments should verify patching across all endpoints. For enterprises unable to update immediately, supplementary controls include restricting access to untrusted websites via web filtering, disabling JavaScript if feasible for high-risk users, or leveraging Chrome enterprise policies to enforce rapid updates. Defense-in-depth measures such as EDR (Endpoint Detection and Response) monitoring, network segmentation, and browser isolation (running Chrome in a sandbox or virtual container) can reduce the likelihood of successful exploitation and subsequent lateral movement.

Patch guidance

Verify that Chrome has been updated to version 149.0.7827.53 or later. Users can check their version at chrome://settings/help, which will also trigger an immediate update check. In enterprise environments, administrators should use Chrome's device management console or group policy to enforce the minimum version requirement. Rollout should be prioritized for high-risk users (executives, finance, HR) and public-facing roles. Stagger deployment if necessary to catch any regressions, but aim for full deployment within 5–7 business days given the HIGH severity and ease of exploitation. No workarounds beyond patching are vendor-recommended; isolation and monitoring are supplementary only.

Detection guidance

Detecting exploitation is challenging at the network level because the attack is delivered via standard HTTPS web traffic. However, endpoint-level detection can focus on: (1) unusual child process spawning from the Chrome sandbox process (e.g., cmd.exe or powershell.exe launched by chrome.exe), (2) Chrome accessing unusual memory regions or making unexpected system calls, and (3) crashes or instability in chrome.exe preceded by visits to untrusted sites. EDR tools with behavioral analysis and memory inspection capabilities are more effective than signature-based detection. Monitor for CWE-416 indicators: heap corruption, buffer overflow crashes, or ASAN (Address Sanitizer) warnings in Chrome logs if debug builds are deployed. Correlate Chrome update status with endpoint vulnerability scans to identify systems still running versions prior to 149.0.7827.53.

Why prioritize this

This vulnerability warrants immediate prioritization because it combines a HIGH CVSS score (8.8), straightforward exploitability (network-based, no special privileges, user interaction common in normal browsing), and a large user base (Chrome is the dominant browser on Windows). The use-after-free in graphics processing is a well-understood attack surface; sandbox escapes from this class of vulnerability have been demonstrated, and advanced threat actors actively exploit similar flaws. The lack of KEV listing does not indicate low risk—it reflects the recency of the advisory and lack of observed wild exploitation, not low severity. Organizations should treat this as a critical patch requiring immediate action, especially for any user accessing sensitive data or systems via the browser.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: (1) Network exploitability (AV:N) with low attack complexity (AC:L), making it trivial to deliver; (2) no privileges or special setup required (PR:N); (3) user interaction limited to clicking a link or visiting a website (UI:R), a routine action; and (4) high impact on confidentiality, integrity, and availability (C:H, I:H, A:H) within the sandbox scope. The sandbox boundary prevents direct OS compromise (Scope:Unchanged) but does not mitigate the risk of data theft, credential harvesting, or preparation for follow-on attacks. For enterprises, the real-world risk may be elevated if users are likely to encounter the attack vector or if the environment includes vulnerable configurations (outdated Chrome deployments, weak update policies).

Frequently asked questions