CVE-2026-10979: Chrome ANGLE Out-of-Bounds Read Memory Disclosure Vulnerability

Technical summary

CVE-2026-10979 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer underlying Chrome's rendering pipeline. The flaw permits reading memory regions beyond the bounds of an allocated buffer, classified as CWE-125 (Out-of-bounds Read). A remote attacker delivers a crafted HTML page via network; when rendered by a vulnerable Chrome instance, the malformed content triggers the out-of-bounds read during graphics processing. The attacker gains read access to arbitrary process memory without modifying data or causing denial of service. The Chromium project assigned this a High security severity rating.

Business impact

This vulnerability poses a confidentiality risk to Chrome users. Attackers can harvest sensitive data resident in Chrome's memory—including session credentials, cached passwords, API keys, or personal information from loaded web pages—without triggering obvious signs of compromise. The attack requires user click-through but no social engineering expertise beyond standard phishing or malvertising tactics. Organizations relying on Chrome for secure web access should prioritize updates, particularly if users regularly handle sensitive data in-browser or access high-value cloud services via Chrome.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. This includes all Chrome releases on Windows, macOS, and Linux distributions carrying the affected version range. The vulnerability does not affect other Chromium-based browsers unless they incorporate the same vulnerable ANGLE code without remediation. Users on auto-update may already be protected if their instance has reached version 149.0.7827.53 or later.

Exploitability

Exploitability is moderate to moderately high. The attack surface is broad (any website or HTML-bearing content) and requires only user interaction—visiting a malicious page or clicking a link. No authentication, elevated privileges, or complex user actions are needed beyond standard browsing. However, reliable exploitation depends on precise crafting of graphics commands to trigger the read at a desired memory offset, which may require attacker reconnaissance of the target process layout. The out-of-bounds condition itself is not user-controlled in terms of which memory is read, limiting attacker precision without additional information leaks.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically rolls out patches within hours to days of release. Verify the updated version via Chrome's About page (chrome://about or Chrome menu > About Google Chrome), which will confirm the installed build number. For enterprise environments, administrators should trigger policy-driven updates or validate endpoint compliance through device management tools. No workarounds exist short of disabling JavaScript or restricting web content, which is impractical for normal browsing.

Patch guidance

Google's Chromium security releases are delivered via the stable channel. Users with auto-update enabled should receive version 149.0.7827.53 automatically within a short window. Enterprise administrators managing Chrome via policy should verify rollout to their fleet and confirm build numbers via reporting tools. Extended support channels (ESR versions, if applicable) will receive patches on their respective schedules—consult your organization's Chrome deployment model. Test the update in a non-critical environment first if your organization makes updates centrally, though this patch addresses a remote code execution precursor and should be deployed with urgency.

Detection guidance

Monitor for signs of exploitation via network-based and endpoint-based telemetry. Network sensors should flag suspicious HTML served from known malicious domains or C2 servers. Endpoint detection should monitor for Chrome crashes or unexpected memory access patterns during graphics rendering, though out-of-bounds reads may execute silently if the attacker successfully exfiltrates data. Browser forensics and memory dumps of Chrome processes after suspected compromise may reveal telltale artifacts of crafted graphics commands. Consider deploying content filtering to block known phishing or malvertising campaigns leveraging this CVE. Monitor for derivative attacks (credential misuse, lateral movement) following memory disclosure.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), the practical risk is elevated for environments where Chrome users access sensitive services or handle valuable data in-browser. The vulnerability is remotely exploitable with only user interaction required, making it suitable for mass-targeting via malvertising or watering-hole tactics. The confidentiality impact (high) and the difficulty in detecting attacks post-exploitation elevate concern. This should not be deferred; treat it as priority for deployment within the first week of patch availability, particularly for high-value user populations.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects attack vector: network, attack complexity: low, no privileges required, user interaction required, and high confidentiality impact with no integrity or availability impact. The score is conservative relative to real-world risk because it does not account for the high frequency of Chrome use in modern enterprises, the difficulty of detecting silent memory exfiltration, or the prevalence of phishing-based attack chains. Organizations handling PII, credentials, or intellectual property in-browser should consider this a 7 or higher for internal risk scoring.

Frequently asked questions