CVE-2026-11138: Chrome ANGLE Memory Leak Exposes Cross-Origin Data

Technical summary

CVE-2026-11138 is an uninitialized use vulnerability (CWE-457) in ANGLE, Chrome's abstraction layer for graphics APIs. Insufficient initialization of memory structures in ANGLE can be triggered by a crafted HTML page, potentially allowing an attacker to read uninitialized memory. This uninitialized memory may contain sensitive data from other security origins, bypassing the same-origin policy. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with a network-based attack vector requiring user interaction but no special privileges.

Business impact

This vulnerability creates a confidentiality risk for users of affected Chrome versions. Corporate environments where employees browse the web face exposure of sensitive information that may be resident in browser memory—including credentials, session tokens, or proprietary data from previously visited sites. The attack requires social engineering or compromised web properties to deliver the malicious HTML, making it practical for targeted threat actors. Organizations cannot rely on network isolation alone, as the attack initiates from a website users visit directly.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. The issue affects Chrome across all supported operating systems: Windows, macOS, and Linux. While the CVE references these operating systems and the Linux kernel, the practical impact centers on Chrome installations; administrators should verify Chrome version across their fleet regardless of OS platform.

Exploitability

The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no publicly known active exploitation at this time. However, the attack complexity is low and requires only user interaction—a user must visit an attacker-controlled or compromised webpage. This relatively low barrier means exploitation could become practical if security researchers or threat actors develop proof-of-concept code or if malicious actors gain control of high-traffic websites. The medium CVSS score reflects the confidentiality impact balanced against the requirement for user interaction.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately across all endpoints. Chrome's auto-update mechanism typically handles this automatically, but organizations should verify completion, especially in environments with delayed or controlled updates. No workarounds mitigate the underlying flaw; patching is the only reliable remediation. Verify the installed version via chrome://version/ or through enterprise management tools.

Patch guidance

Deploy Chrome 149.0.7827.53 or any subsequent release. Organizations using Chrome Enterprise or managed Chrome deployments should confirm the patch has been applied via their management console. For unmanaged or personal devices, users should enable automatic updates and verify their current version. There are no interim patches or partial mitigations; full version updates are required.

Detection guidance

Monitor Chrome version compliance across your environment using endpoint management, SIEM, or asset inventory tools to ensure 149.0.7827.53 or later is deployed. Browser telemetry or MDM solutions can track version status across Windows, macOS, and Linux systems. Behavioral detection of memory-based data exfiltration is difficult at the host level, so prevention through patching is more practical than post-compromise detection. Network-level detection of malicious HTML is challenging without content inspection; focus remediation efforts on rapid patching and user awareness.

Why prioritize this

Although marked Medium severity, this vulnerability should be prioritized for rapid patching due to its low attack complexity, wide affected user base, and confidentiality impact. Chrome's auto-update mechanism reduces deployment friction, making timely patching achievable. Threat actors actively targeting confidential corporate data may craft campaigns exploiting this flaw before patches are universally applied. The lack of KEV status does not indicate low risk; it reflects current absence of known public exploitation—a temporary condition.

Risk score, explained

The CVSS 6.5 (Medium) score appropriately reflects a network-based attack requiring user interaction, with confidentiality impact but no integrity or availability effects. The uninitialized memory condition is deterministic once triggered, making the attack outcome reliable for attackers. For organizations handling sensitive client data or employee credentials, the actual business risk may exceed the numerical score due to the confidentiality exposure and ease of delivery via social engineering.

Frequently asked questions