CVE-2026-11004: Chrome ANGLE Out-of-Bounds Read Memory Disclosure

Technical summary

This vulnerability is an out-of-bounds read (CWE-125) in ANGLE, Chrome's graphics abstraction layer. The flaw allows an attacker operating within a compromised renderer process to construct a specially crafted HTML page that triggers an out-of-bounds memory access. This read operation can leak sensitive information resident in process memory. The vulnerability affects Chrome prior to version 149.0.7827.53 on Windows, macOS, and Linux systems.

Business impact

This vulnerability poses a secondary data exposure risk in multi-stage attack chains. Once an attacker has already compromised a renderer process (via another vulnerability or phishing), CVE-2026-11004 enables them to harvest sensitive data from Chrome's memory—potentially including cached credentials, session tokens, or other sensitive information. Organizations should prioritize closing the initial attack vector rather than treating this as a standalone entry point, but timely patching limits an attacker's toolkit after renderer compromise.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable on all major platforms: Windows, macOS, and Linux. Any user or system running an unpatched Chrome browser is at risk if a renderer process is compromised through a separate attack vector.

Exploitability

Exploitation requires two conditions: (1) the attacker must first compromise Chrome's renderer process through another vulnerability or social engineering, and (2) the user must then visit or interact with a crafted HTML page. The CVSS score of 5.3 (Medium) reflects this two-stage requirement. Exploitation is not trivial or remotely triggerable in isolation; it is a post-compromise tactic rather than an initial access vector. KEV status is not active, indicating no widespread exploitation in-the-wild has been reported as of the data collection date.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome typically auto-updates, but users should verify their installed version via Chrome menu > About > Chrome or Settings. Administrators managing browser deployments should ensure update policies enforce this version floor. Additionally, maintain vigilance against the primary attack vectors (such as browser exploits or phishing) that would allow initial renderer process compromise.

Patch guidance

Install Chrome 149.0.7827.53 or any subsequent version released after June 4, 2026. Users with auto-update enabled should receive this patch automatically; verify successful installation by navigating to About Chrome. Enterprise administrators should confirm patch deployment across managed devices and consider setting Chrome to auto-update if not already configured. No interim mitigations are documented; patching is the primary remediation.

Detection guidance

Direct detection of exploitation attempts is difficult without browser instrumentation. Organization-level detection efforts should focus on: (1) confirming Chrome versions across deployed devices to identify unpatched instances, (2) monitoring for anomalous memory access patterns if you have deep visibility into browser process behavior, and (3) tracking for indicators of the upstream compromise vector (the attack that first compromises the renderer). Intrusion detection systems tuned to catch browser exploit patterns will indirectly help prevent the prerequisite renderer compromise.

Why prioritize this

While the CVSS score is Medium (5.3), this vulnerability should be treated as a supporting element in a broader attack strategy rather than a critical standalone risk. Prioritize patching to deny attackers an additional data exfiltration technique post-compromise, but do not let it overshadow efforts to prevent renderer process compromise in the first place. Teams should patch within their standard update cycles, prioritizing systems that face high-risk browsing activity or handle sensitive data.

Risk score, explained

The CVSS 5.3 (Medium) score reflects: Attack Vector (Network), Access Complexity (High), Privileges Required (None), User Interaction (Required), Scope (Unchanged), Confidentiality Impact (High), Integrity (None), and Availability (None). The 'High' complexity and requirement for user interaction reduce the raw severity. However, the High confidentiality impact is offset by the fact that exploitation requires prior renderer compromise, lowering the overall numeric score. This represents a real but conditional information disclosure risk.

Frequently asked questions