CVE-2026-10955: Type Confusion in Chrome ANGLE on Windows – Critical Patch Required

Technical summary

CVE-2026-10955 is a type confusion vulnerability (CWE-843) in ANGLE, Google Chrome's GPU abstraction layer on Windows. The flaw allows remote code execution through out-of-bounds memory access when processing specially crafted HTML content. The attack vector is network-based with low complexity; exploitation requires user interaction but no authentication. The vulnerability affects Chrome versions prior to 149.0.7827.53. Type confusion vulnerabilities in graphics drivers and rendering engines are particularly dangerous because they often operate in privileged contexts and handle untrusted input (web content) at scale.

Business impact

This vulnerability poses a significant risk to any organization where employees use Chrome on Windows systems to access the internet. A successful exploit could result in credential theft, intellectual property theft, or installation of persistent malware. The requirement for user interaction means targeted phishing campaigns combining this vulnerability with social engineering could be particularly effective. Organizations relying on Chrome as their primary browser face elevated risk until patching is complete, especially in industries handling sensitive data or intellectual property.

Affected systems

Google Chrome on Microsoft Windows prior to version 149.0.7827.53 is vulnerable. The vulnerability does not affect Chrome on other platforms (macOS, Linux, Android, iOS) or non-ANGLE based browsers. Windows systems running Chrome are the sole target. Organizations should verify their Chrome version to determine exposure scope.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing a user to visit it, which is a moderate barrier but achievable through phishing, compromised advertisements, or malicious websites. Once a user visits the page, exploitation is reliable and does not require user awareness or additional interaction beyond the initial visit. No public exploit code is known to exist at this time, and the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the simplicity of the attack surface (any website, any HTML) means this could be weaponized quickly once attack code is published.

Remediation

Immediate remediation is to update Google Chrome to version 149.0.7827.53 or later on all Windows systems. Chrome typically auto-updates, but administrators should verify completion. For organizations unable to patch immediately, restrict Chrome usage to internal, vetted websites and disable plugin execution if feasible. Consider browser isolation or sandboxing solutions for high-risk users accessing untrusted content. Verify patch deployment across your fleet before considering the vulnerability resolved.

Patch guidance

Update Chrome via Settings > About Chrome, which typically triggers an automatic update check. Organizations managing Chrome through Active Directory or mobile device management should push version 149.0.7827.53 or higher. Verify the patch by checking Chrome version (chrome://version) across representative systems. Test patch deployment in a non-production environment first if your organization uses Chrome extensions or internally-hosted web applications, to ensure compatibility. Google typically releases patches on Tuesdays; check the Chrome Releases blog for confirmation of availability.

Detection guidance

Monitor Chrome version inventory across Windows endpoints using endpoint detection and response (EDR) tools or mobile device management platforms. Look for browsers reporting versions below 149.0.7827.53. Web application firewalls may detect exploit attempts if they include suspicious JavaScript patterns targeting graphics processing or memory manipulation, though ANGLE vulnerabilities are often difficult to detect at the network layer. Endpoint telemetry may show unusual GPU memory access or renderer process crashes as indirect indicators of exploit attempts. Prioritize detection of unpatched systems over detection of active exploitation, given the vulnerability is not yet widely exploited.

Why prioritize this

This vulnerability warrants urgent attention due to its high CVSS score (8.8), network attack vector, low attack complexity, and potential for broad impact across Windows-using organizations. The requirement for user interaction is the primary mitigating factor, but it does not substantially lower risk given how frequently employees browse the web. The lack of KEV status indicates no known widespread exploitation yet, providing a window to patch before real-world attacks materialize. Organizations should treat this as a critical priority for Windows Chrome users.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a high-severity vulnerability with significant impact potential. The score components: AV:N (network-exploitable from any website), AC:L (low attack complexity—no special conditions required), PR:N (no privileges needed), UI:R (user interaction required—visiting a page), S:U (no scope escalation), and confidentiality/integrity/availability all set to High (full impact possible). The score appropriately captures the balance between broad exploitability and the user-interaction requirement. The Chromium security team's 'High' severity rating aligns with this CVSS assessment.

Frequently asked questions