CVE-2026-10994: Google Chrome ANGLE Memory Disclosure Vulnerability – Update to 149.0.7827.53

Technical summary

CVE-2026-10994 is an uninitialized use vulnerability (CWE-457) in the ANGLE (Almost Native Graphics Layer Engine) library integrated into Chromium. When ANGLE processes graphics operations from a crafted HTML page, it may reference memory that was never properly initialized, allowing an attacker to read arbitrary process memory contents. The vulnerability is triggered via standard web content without requiring elevated privileges or disabling security features. The information disclosure occurs in the renderer process, which runs in a sandbox but still has access to sensitive browser state.

Business impact

Information disclosure vulnerabilities in browsers pose a direct risk to users handling sensitive data. Organizations where employees browse untrusted content or receive phishing emails with malicious links face exposure of credentials, session tokens, and cached sensitive information. While this is not a code execution or authentication bypass vulnerability, the ability to extract memory contents can be chained with other attacks or used for targeted espionage. Companies with strict data protection policies may need to accelerate patching timelines to remain compliant.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. This includes all Chrome instances on Windows, macOS, Linux, Android, and iOS running earlier versions. Chrome's rapid release cycle means multiple older versions may be in use across organizations. Desktop browsers in automated update mode will receive the fix automatically; however, managed environments, mobile deployments, and older branch versions may require manual patch coordination.

Exploitability

Exploitation is straightforward from a delivery perspective: an attacker hosts a malicious webpage and tricks or directs users to visit it. No user awareness of technical details is required—simply loading the page in a vulnerable Chrome instance triggers the vulnerability. However, reliably extracting meaningful information from uninitialized memory is non-trivial; the attacker must work around Chrome's memory layout randomization (ASLR) and guess what sensitive data may be present at specific memory addresses. This reduces the practical success rate against a diverse target set, though targeted attacks on specific users or systems are feasible.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. On Windows and macOS, enable automatic updates or manually check Help > About Google Chrome to trigger the update. On Linux, use your package manager or rebuild from official Google repositories. Mobile users should update through their respective app stores. For enterprise environments, use Chrome's update policies (group policies on Windows, configuration profiles on macOS, or managed Google Play on Android) to enforce the patch across your fleet. Verify rollout completion within 5–7 days.

Patch guidance

Google released version 149.0.7827.53 as a stable channel update addressing this vulnerability. Organizations should prioritize patching within two weeks. For change-sensitive environments, test the update on a representative subset of systems before fleet-wide deployment, though Chrome updates are generally low-risk. If you manage mobile Chrome deployments, confirm that your MDM or app distribution channel delivers the patched version. For off-net or legacy systems, consider forcing an update check or scheduling a maintenance window. Verify the update was successful by checking chrome://version in the address bar.

Detection guidance

Detection of exploitation attempts is difficult without visibility into Chrome's renderer process memory. However, you can monitor for behavioral indicators: watch for unusual network activity originating from Chrome processes shortly after users visit unknown sites, spikes in SSL certificate errors (which may indicate memory corruption side-effects), or Chrome crashes followed by memory dumps. Organizations using endpoint detection and response (EDR) tools can create rules to alert on Chrome process anomalies or unexpected child processes. Additionally, track Chrome version across your fleet using mobile device management (MDM), endpoint management platforms, or browser telemetry to ensure vulnerable versions are not in use.

Why prioritize this

This vulnerability merits priority patching despite its medium severity score. Information disclosure from browser memory can expose high-value secrets (API keys, session tokens, authentication credentials) that attackers actively seek. The low barrier to exploitation—visiting a webpage—combined with the sensitivity of data at risk makes this a credible threat, especially in organizations where users regularly visit external sites or receive socially engineered links. The simplicity of patching (automatic updates for most users) makes the effort-to-risk ratio favorable for rapid remediation.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects high confidentiality impact (C:H) and network accessibility (AV:N) with low attack complexity (AC:L), offset by the requirement for user interaction (UI:R) and absence of integrity or availability impact. The score appropriately captures that this is a significant information disclosure risk that is easy to trigger but limited in scope to confidentiality. In a real-world context, organizations handling PII, credentials, or financial data should treat this as higher priority than the CVSS rating alone suggests.

Frequently asked questions