CVE-2026-14402: Chrome ANGLE Memory Disclosure Vulnerability (Windows)

Technical summary

CVE-2026-14402 is a CWE-457 (use of uninitialized variable) vulnerability in ANGLE, Chrome's Direct3D abstraction layer on Windows. When processing specially crafted graphics commands in HTML5 Canvas or WebGL contexts, ANGLE fails to initialize buffer memory before use, permitting an attacker to infer or exfiltrate uninitialized heap contents. The vulnerability requires user interaction (visiting a malicious page) and executes within the renderer process sandbox, but the sandbox is not designed to prevent side-channel memory reads. Affected versions include Chrome 149 and earlier on Windows; Chrome 150.0.7871.46 and later on Windows address this issue.

Business impact

This vulnerability represents a confidentiality risk to organizations where employees browse untrusted content or encounter drive-by compromises. Attackers could harvest session cookies, authentication tokens, or clipboard data from user browsers, potentially enabling account takeover or lateral movement. The threat is elevated in high-value targets (finance, legal, government sectors) where browser memory may contain classified or sensitive information. The sandwich-layer nature of the flaw (graphics library, user interaction required) makes it lower-tier for broad exploitation compared to network-facing code execution, but viable for targeted social engineering.

Affected systems

Google Chrome versions prior to 150.0.7871.46 on Windows systems are vulnerable. This includes Chrome 149, 148, and earlier releases. Users on macOS, Linux, and ChromeOS are not affected, as ANGLE is Windows-specific. The vulnerability does not affect Chrome on Android. Organizations running extended support or managed Chrome deployments should audit version compliance across their Windows user base.

Exploitability

Exploitation requires crafted HTML delivered to a user and user-initiated browsing (clicking or being redirected to the malicious page). No authentication is required, and the network attack surface is standard web browsing. The attack surface is broad but not passive; the attacker cannot trigger exploitation without user action. Detection evasion is feasible since graphics-related memory leaks may not trigger obvious visual artifacts or crash signatures. No public exploit code is known to be in circulation; this is a pre-patch disclosure with no evidence of in-the-wild attacks or active development.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. For Windows systems, leverage Chrome's auto-update mechanism or manually verify the version via Settings > About Google Chrome. Enterprise deployments should push the update via group policy or mobile device management. For users unable to update immediately, disabling JavaScript execution or using a separate browser for untrusted sites provides temporary mitigation, though this is not a substitute for patching.

Patch guidance

Google Chrome 150.0.7871.46 and later on Windows includes a fix that properly initializes ANGLE graphics buffer memory. Verify the installed version via the About page (Settings > About Google Chrome); the browser will auto-update, but users can manually trigger the check if needed. No additional configuration is required after patching. Rollback is not recommended given the security nature of the fix.

Detection guidance

Monitor Chrome crash reports for graphics-related renderer process exits, as exploitation may cause instability. Inspect network traffic for suspicious redirects to known malware distribution domains. EDR or XDR tools can flag unusual memory access patterns in Chrome processes, though ANGLE exploitation may blend into normal graphics operations. Patch compliance auditing is the primary detection lever: scan Windows systems for Chrome versions below 150.0.7871.46 using SCCM, MDM, or endpoint discovery tools. Security event logging in browsers (Chrome sync, page visit history) may show signs of post-compromise account activity if memory data was used for session hijacking.

Why prioritize this

This vulnerability merits near-term patching (within 2–4 weeks) but does not require emergency (same-day) response. It is rated MEDIUM severity by CVSS due to network accessibility and user interaction requirement, yet the Chromium security team assigned it High severity because memory disclosure in renderer contexts can be chained with other flaws or misused in targeted campaigns. Organizations with high-value users, compliance requirements (healthcare, finance, law), or low-privilege browser sandboxing should prioritize sooner.

Risk score, explained

CVSS 3.1 score of 6.5 reflects: (1) Network Attack Vector—any website can host the exploit; (2) Low Attack Complexity—no special conditions required beyond crafted HTML; (3) No Privileges Required; (4) User Interaction Required—click/navigation necessary; (5) User Scope unchanged; (6) High Confidentiality Impact—arbitrary memory read; (7) No Integrity or Availability impact. The Chromium High rating reflects the real-world risk of memory disclosure in a browser context, where sensitive data frequently resides and can be weaponized in targeted attacks despite the CVSS Medium label.

Frequently asked questions