CVE-2026-14400: Chrome ANGLE Out-of-Bounds Write & Sandbox Escape

Technical summary

CVE-2026-14400 is an out-of-bounds write vulnerability (CWE-787) residing in ANGLE, the cross-platform graphics abstraction layer used by Chrome. The vulnerability exists in versions prior to 150.0.7871.46. An attacker with control of the renderer process can trigger an out-of-bounds write via a malicious HTML page, potentially breaking out of the renderer sandbox and executing code with elevated privileges. The attack chain requires a prior compromise of the renderer, making this a post-sandbox-break vulnerability rather than a first-stage exploit.

Business impact

While this vulnerability cannot directly compromise a system from a remote webpage alone, it significantly amplifies risk when combined with other renderer vulnerabilities. Organizations where employees browse untrusted content face elevated risk of complete system compromise if this flaw is chained with a renderer RCE. For enterprises using Chrome in security-sensitive contexts (e.g., isolated browsing for high-value targets), this represents a critical gap that could enable lateral movement and persistence following an initial breach. Delayed patching leaves organizations vulnerable to multi-stage attacks.

Affected systems

Google Chrome versions before 150.0.7871.46 on all platforms (Windows, macOS, Linux) are affected. Users of Chromium-based browsers that vendor the same ANGLE code may also be at risk; verify against your specific browser vendor's advisory. Chrome's auto-update mechanism should deploy fixes automatically, but enterprises with update management policies should prioritize rollout.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised, typically via a separate vulnerability, and (2) the attacker must control the HTML content served to the compromised renderer. The CVSS score of 8.3 reflects the high impact (sandbox escape) balanced against the prerequisite of prior renderer compromise. This is not a wormable or zero-click vulnerability; it serves as a powerful privilege escalation in multi-stage attack chains. Currently, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active wild exploitation has not been confirmed at publication.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. Most users will receive this patch automatically via Chrome's built-in updater; verify in chrome://settings/help. Enterprise administrators should confirm rollout through their update management systems and consider forcing updates on managed devices if auto-update delays are a concern. No workarounds exist; patching is the only mitigation.

Patch guidance

Immediately prioritize patching to Chrome 150.0.7871.46 or later. For enterprises: (1) verify current fleet versions via mobile device management (MDM) or endpoint detection tools; (2) establish a mandatory update deadline within 7–14 days; (3) test patches in a staging environment if your organization has custom Chrome configurations; (4) communicate urgency to users, emphasizing the sandbox-escape risk. If auto-update is delayed in your environment, manually trigger updates via chrome://settings/help or push updates via group policy (Windows) or configuration profiles (macOS).

Detection guidance

Direct detection of exploitation is difficult because the vulnerability operates within the renderer sandbox. Monitor for: (1) unusual Chrome process behavior or child process creation outside normal renderer boundaries; (2) system-level API calls from Chrome that indicate sandbox escape (e.g., direct file system access, registry modifications on Windows); (3) memory corruption indicators or crash dumps from ANGLE components; (4) network indicators associated with multi-stage attacks (initial renderer compromise followed by lateral movement). Leverage EDR and behavioral analytics tools to flag anomalous Chrome activity. Proactive detection is best achieved through patching velocity monitoring to ensure timely updates across your estate.

Why prioritize this

This vulnerability merits urgent attention despite its requirement for prior renderer compromise. ANGLE graphics vulnerabilities have historically been high-impact, and sandbox escapes are among the most valuable post-breach capabilities for attackers. The combination of high CVSS (8.3), Chromium's High severity rating, and the ubiquity of Chrome in enterprise environments creates substantial risk. Even though it is not yet in the KEV catalog, proactive patching prevents its use as a persistence or lateral-movement vector in sophisticated attacks. Organizations should patch within their standard critical/high-priority timelines.

Risk score, explained

The CVSS 8.3 HIGH score reflects: (1) high impact (confidentiality, integrity, availability all marked high due to sandbox escape enabling system-level compromise); (2) network vector (the attack originates from remote content); (3) moderate attack complexity (requires prior renderer compromise and user interaction to load the malicious page); (4) no privilege requirement for the initial vector (though impact is elevated). The score appropriately captures the severity of a sandbox escape but accounts for its dependency on prior renderer compromise, preventing a critical (9.0+) rating.

Frequently asked questions