CVE-2026-10919: Chrome ANGLE Use-After-Free Sandbox Escape (v149)

Technical summary

This vulnerability is a use-after-free condition (CWE-416) in the ANGLE graphics translation layer used by Chrome. When a compromised renderer process provides specially crafted input, a freed memory object is accessed, leading to memory corruption. The attack chain requires prior renderer compromise—typically via a separate browser vulnerability—but once achieved, the use-after-free enables arbitrary code execution in the system process context, circumventing Chrome's multi-process sandbox model. The vulnerability affects Chrome on Windows, macOS, and Linux.

Business impact

Organizations relying on Chrome as a primary browser face increased risk of full system compromise when end users visit malicious sites. If an attacker chains this sandbox-escape flaw with another Chrome vulnerability to first compromise the renderer, they gain OS-level code execution. This enables data exfiltration, lateral movement, and potential ransomware deployment. Enterprises managing heterogeneous endpoints must coordinate patching across multiple operating systems simultaneously.

Affected systems

Google Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux are vulnerable. The flaw affects the ANGLE subsystem, which is integral to Chrome's graphics rendering pipeline. All users on these platforms with unpatched Chrome installations are at risk if they visit a site hosting both a renderer-compromise vector and the ANGLE exploit payload.

Exploitability

Exploiting this vulnerability requires a two-stage attack: first compromising the renderer process (via a separate vulnerability or social engineering), then supplying the crafted HTML payload. The CVSS vector (AC:H) reflects the high attack complexity needed to orchestrate both stages. While not zero-click, the barrier is moderate for sophisticated threat actors; opportunistic exploitation is less likely. The flaw is not currently tracked in CISA's Known Exploited Vulnerabilities catalog as of the latest advisory update.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected platforms. Chrome's auto-update mechanism will typically deploy the patch automatically within 24 hours; verify rollout completion in your device management console. For organizations with auto-update disabled, manual deployment should be prioritized. Test patch compatibility with line-of-business web applications before broad rollout if your environment has custom configurations.

Patch guidance

Verify Chrome auto-update is enabled in your environment; navigate to chrome://settings/help to confirm. For managed deployments, use the ChromeOS or Chrome Enterprise policies to accelerate rollout. If manual patching is required, obtain the installer from Google's official download page and validate the version post-installation. Organizations with extended support requirements should confirm version 149.0.7827.53 availability in their managed distribution channels before enforcement deadlines.

Detection guidance

Monitor Chrome process execution and graphics subsystem behavior for anomalous patterns. Endpoint detection and response (EDR) tools should flag attempts to access freed heap memory in graphics contexts or unexpected transitions from renderer processes to system-level operations. Network-level detection is limited since the payload is delivered via HTML; focus on behavioral indicators such as unexpected child processes spawned from Chrome or unusual system calls following web browsing activity. Log Chrome version information from all endpoints and cross-reference against 149.0.7827.53 to identify stragglers.

Why prioritize this

This vulnerability merits immediate patching priority due to its HIGH CVSS score (8.3) and sandbox-escape capability. While it requires prior renderer compromise, chaining it with other browser vulnerabilities creates a realistic multi-stage attack scenario that advanced adversaries actively pursue. The cross-platform impact (Windows, macOS, Linux) and integration into Chrome's core graphics pipeline amplify risk across diverse enterprise environments. Patch deployment should begin within 48 hours of release confirmation.

Risk score, explained

The CVSS 8.3 (HIGH) score reflects the combination of network-accessible attack vector, high complexity barrier, required user interaction, and critical impact across confidentiality, integrity, and availability. The score acknowledges that this is a sandbox-escape primitive rather than a remote code execution chain, but the consequences of successful exploitation—full system access—justify the HIGH severity. Scope change (S:C) is included because escaping the browser sandbox directly impacts the broader OS environment.

Frequently asked questions