CVE-2026-11090: Chrome ANGLE Memory Leak Enables Cross-Origin Data Theft

Technical summary

CVE-2026-11090 is an uninitialized memory use vulnerability in ANGLE (a graphics abstraction layer used by Chrome) that enables cross-origin data disclosure. The vulnerability stems from improper handling of uninitialized variables or buffer regions during graphics processing, allowing an attacker to read sensitive data from memory that should be isolated by the same-origin policy. The flaw is classified under CWE-125 (out-of-bounds read), CWE-457 (uninitialized variable), and CWE-787 (out-of-bounds write), indicating multiple potential memory safety issues in the graphics pipeline. Attack surface is the renderer process when handling crafted HTML containing specially constructed graphics commands.

Business impact

A successful exploitation allows attackers to exfiltrate sensitive user data—such as authentication tokens, form data, or private content from other open tabs—without user awareness beyond visiting a malicious site. For organizations where employees browse the web during work, this creates a direct channel for credential theft and lateral movement intelligence gathering. The requirement for user interaction limits mass exploitation but does not eliminate the risk in targeted campaigns. Data loss and compliance violations (GDPR, HIPAA, PCI-DSS depending on data exposed) are potential consequences.

Affected systems

All platforms running Google Chrome prior to version 149.0.7827.53 are affected, including Windows, macOS, and Linux. Apple macOS and Microsoft Windows users are likely the largest populations at risk. Linux systems, including those running the Linux kernel directly alongside Chrome, are also vulnerable. Any organization using Chrome as the primary or approved browser faces exposure across its user base.

Exploitability

Exploitability is moderate. The attack requires a user to visit or be redirected to an attacker-controlled webpage, making it suitable for targeted phishing, watering-hole attacks, or compromise of legitimate sites. No special user privileges or complex interaction patterns are needed beyond a single visit. The medium CVSS score (6.5) reflects the requirement for user interaction (UI:R) balanced against network accessibility and the confidentiality impact. Public exploit code is not known to exist in the wild, but the conceptual simplicity of graphics-based memory leaks suggests reproduction may be straightforward for skilled researchers.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will roll out the patch, but verification is recommended in high-security environments. Organizations using managed Chrome deployments (via Chromebook or enterprise admin controls) should ensure update policies are configured to deploy the patch promptly. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later across all endpoints. For Windows, macOS, and Linux deployments, verify update completion by navigating to chrome://version/ and confirming the version number. In enterprise environments using Google Admin Console, confirm auto-update policies are enabled or manually push the version via deployment tools. Test the patch on a representative sample before full rollout to ensure no regression in compatibility with critical internal or business-critical web applications.

Detection guidance

Monitor for successful Chrome updates via endpoint management tools or audit logs. Behavioral detection is challenging because the exploit leaves minimal forensic artifacts—data exfiltration occurs within the Chrome process memory space without obvious file system activity. Consider browser telemetry if available through enterprise Chrome policies. For incident response, examine Chrome history and open tabs at time of suspected exploitation to identify potentially malicious visited URLs. Memory dumps or crash logs may contain evidence of uninitialized reads, though post-mortem analysis is difficult.

Why prioritize this

This vulnerability merits prompt patching because it enables silent, targeted data exfiltration against web-using employees without triggering obvious user-facing warnings. The medium severity, combined with the widespread use of Chrome in enterprise environments and the low barrier to user exploitation (simply visiting a site), justifies rapid deployment. Organizations handling sensitive data should prioritize this above lower-impact issues. The absence of KEV listing does not reduce urgency; active exploitation may simply not yet be documented.

Risk score, explained

CVSS 6.5 (Medium) reflects a network-accessible, low-complexity attack that requires user interaction but results in high confidentiality impact and no integrity or availability impact. The score appropriately weights the ease of triggering the vulnerability against the serious consequence (cross-origin data leak) and the practical barrier of user click-through. In environments where employees handle regulated data or authentication secrets, the business risk exceeds the base CVSS due to downstream compromise potential.

Frequently asked questions