CVE-2026-11051: Chrome ANGLE Out-of-Bounds Read on Linux – Patch Guide

Technical summary

CVE-2026-11051 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), Chrome's graphics abstraction layer, on Linux platforms. The flaw allows an unauthenticated remote attacker to trigger a memory read operation outside intended buffer boundaries via malicious HTML, violating memory safety controls. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects network exploitability with user interaction required, high confidentiality impact, and no integrity or availability compromise. The underlying cause is classified under CWE-125 (Out-of-bounds Read).

Business impact

Data confidentiality is the primary concern. Attackers exploiting this flaw gain access to sensitive data resident in Chrome's memory during a user's session—including authentication tokens, session identifiers, cached passwords, or in-flight data from web applications. While the browser itself remains functional and data integrity is not affected, successful exploitation can lead to secondary account compromise or credential theft. Organizations relying on Chrome for web-based SaaS platforms should assess whether sensitive transactions occur within the affected version range and the likelihood of users visiting untrusted or compromised websites.

Affected systems

Google Chrome versions prior to 149.0.7827.53 on Linux are vulnerable. The Linux kernel itself is listed in vendor data but the vulnerability is specific to Chrome's ANGLE implementation on Linux systems, not a kernel flaw. Windows and macOS Chrome users are not affected by this particular issue. Verify your Chrome version via chrome://version; auto-update may have already deployed the patch depending on your update cadence.

Exploitability

Exploitation is practical but not trivial. An attacker must craft a specialized HTML page and convince a user to visit it (via phishing, watering hole, compromised advertisement, or social engineering). Once loaded in a vulnerable Chrome instance, the malicious page can reliably trigger the out-of-bounds read. No user-level privileges are required on the target system, and the attack surface is broad—any website visit can be weaponized. However, this is not an in-the-wild 0-day; it was discovered and patched through Google's responsible disclosure process.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all Linux systems. Enable automatic updates to receive patches without user intervention. For environments where auto-update is disabled, schedule a manual update cycle immediately. No workarounds exist; patching is the only mitigation. Users of Chromium-based browsers (Edge, Brave, Opera) on Linux should verify their vendors' patch status, as they may inherit the same ANGLE vulnerability.

Patch guidance

Google Chrome on Linux should auto-update to version 149.0.7827.53 or higher. Administrators can force an update via Settings > About > Check for Updates, or redeploy Chrome through their endpoint management platform. For managed deployments using Chrome Enterprise or Chromium MSI packages, verify that your distribution channel delivers the patched version. Test the patch in a non-production environment first if your organization has critical Chrome-dependent workflows. No rollback is necessary; the patched version is stable and widely deployed.

Detection guidance

Monitor for Chrome version compliance across Linux endpoints using your endpoint detection and response (EDR) or asset inventory tools. Look for any instances of Chrome < 149.0.7827.53 on Linux systems. Web proxies and network monitoring can flag access to known malicious or suspicious HTML content that might exploit this flaw, though the malicious payload itself may not be easily signature-detectable without deep packet inspection. Consider correlating browser crash logs or memory sanitizer warnings from affected versions with suspect website visits as a forensic indicator. No YARA, SNORT, or IDS signatures are necessary for detection—version checking is sufficient.

Why prioritize this

Although assigned a MEDIUM severity score, this vulnerability warrants prompt patching because: (1) it enables silent data theft without user awareness or browser instability, (2) exploitation requires only a malicious webpage and user navigation (low friction), and (3) confidentiality of sensitive in-memory data is high-stakes in modern web applications. Organizations handling customer data, credentials, or financial information via web apps should prioritize this patch. The absence of KEV listing does not indicate low real-world risk; it reflects that the vulnerability was not widely exploited before the patch became available.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: Network-accessible attack vector with low complexity, no privileges required, user interaction mandatory (visiting a webpage), single security context, high confidentiality impact, and zero integrity or availability impact. The score appropriately captures the confidentiality risk while acknowledging that availability and system-level compromise are not possible. Organizations with high-sensitivity data or high-traffic user bases may perceive additional risk beyond the base score.

Frequently asked questions