CVE-2026-11104: Chrome ANGLE Uninitialized Memory Disclosure (CVSS 6.5)

Technical summary

The vulnerability stems from uninitialized variable use (CWE-457) within ANGLE's graphics processing code in Chrome. When the renderer process handles a specially crafted HTML page, uninitialized memory regions may be read and returned to the attacker, bypassing memory safety guarantees. The CVSS 3.1 score of 6.5 reflects high confidentiality impact but no integrity or availability risk; exploitation requires the renderer process to already be compromised, placing this in the post-compromise information exfiltration category rather than remote code execution. The medium Chromium security severity aligns with this risk profile.

Business impact

For organizations running Chrome on employee or customer-facing systems, this vulnerability is primarily a data leakage concern in multi-staged attacks. Once an attacker gains initial renderer access through another vulnerability or social engineering, they can use CVE-2026-11104 to harvest memory contents—potentially including cryptographic keys, authentication tokens, or user data—without further user interaction beyond loading the malicious page. In environments with high-value data or compliance requirements, undetected memory disclosures can lead to regulatory violations and breach notification obligations.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. The vulnerability affects Chrome on Windows, macOS, and Linux. While the CVE lists Linux kernel, Apple macOS, and Microsoft Windows as affected platforms, the flaw itself resides in Chrome's ANGLE component; patching Chrome is the primary remediation. Organizations using Chromium-based browsers (Edge, Opera, Brave, etc.) should verify whether those vendors have backported the fix or released their own patches.

Exploitability

Exploitation requires a two-stage attack chain. First, the attacker must compromise the Chrome renderer process through another means—such as a separate memory corruption bug, drive-by download, or malicious script injection. Second, they serve a crafted HTML page to trigger uninitialized memory reads. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects that the attack is network-reachable but requires user interaction (UI:R, likely page load). The vulnerability does not appear in the Known Exploited Vulnerabilities (KEV) catalog, suggesting no public evidence of active exploitation. This does not guarantee it will remain unexploited; the technical details are relatively straightforward for skilled attackers with renderer access.

Remediation

Upgrade Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically deploys patches automatically, but verify in Settings > About that your version is current. No workarounds exist short of disabling JavaScript or avoiding untrusted websites, both impractical in most environments. Chromium-based browser users should check their vendor's security advisories for corresponding patches.

Patch guidance

Verify that Chrome has auto-updated to 149.0.7827.53 or later by navigating to Chrome Settings > About Chrome, which forces a check for updates. If auto-update is disabled in your organization, manually distribute and apply the update via your mobile device management (MDM) or software distribution infrastructure. Test the patch in a limited environment first to ensure no compatibility regressions with enterprise extensions or internal web applications. For devices that cannot be updated immediately, consider network controls (proxy filtering) to block malicious sites if you have active threat intelligence on exploitation.

Detection guidance

Monitor Chrome version telemetry in your endpoints to identify stragglers still running versions prior to 149.0.7827.53. Behavioral detection is challenging because the attack leaves only renderer process memory artifacts; standard EDR logs may not capture uninitialized memory reads. Focus on detecting the prerequisite renderer compromise: look for unexpected child processes spawned by Chrome, unusual memory allocation patterns, or suspicious network connections from the renderer. Pair this with web gateway logs to spot attempts to serve crafted HTML pages to your users.

Why prioritize this

While CVSS 6.5 places this in the medium-severity band, prioritization should account for two factors: (1) the prevalence of Chrome in enterprise environments makes this a wide-attack-surface issue, and (2) exploitation requires a prior compromise, making this a risk amplifier in targeted or APT scenarios. Organizations facing advanced threats or handling sensitive data should treat this as high-priority within their medium-severity queue. Less sophisticated threat actors are unlikely to chain this with another exploit unless there is clear payoff, so lower-risk environments may safely stage this as part of regular patch cycles.

Risk score, explained

CVSS 6.5 (Medium) is appropriate: uninitialized memory disclosure (CWE-457) in a high-value process (Chrome renderer) with high confidentiality impact, but no code execution or denial-of-service vector. The medium Chromium severity designation reflects Google's assessment that this requires renderer compromise as a prerequisite. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) correctly penalizes the user interaction requirement and awards high confidentiality risk. This is not a worm or mass-exploitation vector; it is a precision tool in a larger attack chain.

Frequently asked questions