CVE-2026-14386: Chrome ANGLE Out-of-Bounds Memory Read Vulnerability

Technical summary

CVE-2026-14386 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), Chrome's WebGL and graphics abstraction layer. The flaw allows reading memory beyond intended buffer boundaries, enabling information disclosure via remote code execution through a crafted HTML page. The vulnerability is classified as CWE-125 (Out-of-bounds Read). Exploitation requires user interaction and does not provide code execution or availability impact; the attack surface is limited to information confidentiality.

Business impact

The primary risk is confidential data exposure. If your organization's users visit compromised or attacker-controlled sites while using affected Chrome versions, sensitive information in process memory—including credentials, session tokens, API keys, or personal data—could be exfiltrated without additional exploitation. This is especially concerning in zero-trust or high-sensitivity environments where browser-based attacks are a known vector. The requirement for user interaction limits the attack to social engineering or watering-hole scenarios rather than mass exploitation.

Affected systems

Google Chrome versions prior to 150.0.7871.46 are vulnerable. Patch status and availability should be verified against Google's official release notes; as of the publication date (July 1, 2026), Chrome users running version 150.0.7871.46 or later are protected. Chromebooks, Chrome OS devices, and any system running an unpatched Chrome browser are in scope. Other Chromium-based browsers (Edge, Brave, Opera, etc.) may be affected depending on their version tracking and release cycle relative to Chrome 150.

Exploitability

Exploitability is moderate. The attack requires a user to visit a malicious or compromised website, making it suitable for targeted phishing, drive-by watering-hole attacks, or supply-chain compromises of legitimate sites. The CVSS score of 6.5 (Medium) reflects the requirement for user interaction (UI:R) and the absence of code execution or system availability impact. However, the attack is reliable once a victim is on the attacker's page and requires no browser plugin, feature flag, or advanced configuration—making it practical for real-world threat actors.

Remediation

Update Chrome to version 150.0.7871.46 or later. Chrome's automatic update mechanism should deploy this patch; verify completion by navigating to chrome://settings/help, where Chrome displays the current version and confirms if updates have been applied. For managed environments, use Chrome Enterprise or endpoint management tools to enforce the minimum version. Disable JavaScript as a temporary mitigation is not recommended, as it degrades functionality substantially; focus instead on rapid patching and user awareness training.

Patch guidance

Verify your current Chrome version at chrome://version or chrome://settings/help. Update immediately if you are running any version before 150.0.7871.46. Chrome typically updates automatically in the background and prompts restart; ensure you complete the restart. In enterprise deployments, audit Chrome versions via device management or MDM solutions and push the patch via policy. Verify patches have been applied within 48 hours; this is a Remote Code Execution precursor (information disclosure from process memory) and should be treated with high urgency.

Detection guidance

Monitor for unusual network traffic to unexpected domains from Chrome processes, especially following user browsing activity. Endpoint detection and response (EDR) tools should flag process memory access patterns that align with data exfiltration, though this is subtle and may require behavioral analysis. Look for indicators such as: Chrome process spawning atypical child processes, suspicious DLL/library loads in the graphics stack (d3d11.dll, libgles2.dll, or ANGLE-related modules), or unusual system calls. User awareness training remains the primary defense—encourage reporting of unexpected browser behavior or performance degradation.

Why prioritize this

Although the CVSS score is 6.5 (Medium), this vulnerability warrants high-priority patching due to its confidentiality impact, ease of exploitation (user interaction required but no special privileges), and broad attack surface in Chromium-based browsers. The vulnerability affects all Chrome users and does not appear on the CISA KEV list, suggesting limited active in-the-wild exploitation at publication time—but the low barrier to attack makes this a window of opportunity for proactive defense. Organizations should prioritize patching within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: Attack Vector Network (AV:N)—the vulnerability is remotely exploitable; Attack Complexity Low (AC:L)—no special conditions or knowledge required; Privileges Required None (PR:N)—the attacker needs no prior access; User Interaction Required (UI:R)—the user must click or visit the malicious page; Scope Unchanged (S:U)—only the Chrome process is affected; Confidentiality High (C:H)—sensitive data can be read from memory; Integrity None (I:N)—data cannot be modified; Availability None (A:N)—the browser is not crashed or hung. The Medium severity acknowledges both the information disclosure risk and the user interaction requirement; the High security rating from Chromium reflects the severity of memory disclosure in a widely-used browser.

Frequently asked questions