Out of bounds read in ANGLE in Google Chrome prior to 149

CVE-2026-10889 is an out-of-bounds read in Chrome's ANGLE graphics layer affecting Chrome versions before 149.0.7827.53 on Linux, 149.0.7827.53/54 on Windows and macOS, with corresponding fixes also carried into Android 149.0.7827.59 and Extended Stable 148.0.7778.254 for Windows/macOS. The key detail is the exploitation model in your intel: the attacker must already have *compromised the renderer process* and then use this ANGLE bug to push beyond that boundary.

Vendor-style scoring overstates the fleet risk for defenders because it treats the bug's end-state impact more than its real-world prerequisite chain. In practice this is a *chain component* for a browser sandbox escape path: dangerous for targeted exploitation and red-team quality chains, but sharply constrained by the need for a separate renderer compromise first, the absence of KEV listing, the very low EPSS, and no visible public PoC for this specific CVE.

Why this verdict

• Major downward adjustment: exploitation requires a *compromised renderer process*, which implies the attacker already owns a separate Chrome bug and is now chaining this one post-initial-exploit.
• Population is narrower than CVSS suggests: every target must be on a vulnerable Chrome build *and* on a platform/runtime path that exercises the vulnerable ANGLE/GPU behavior reliably.
• Threat intel is cold: no KEV listing, no public PoC found, and the provided EPSS is extremely low, which argues against broad opportunistic weaponization.

Why not higher?

If this were reachable directly from a crafted page without the renderer-compromise prerequisite, it would stay in HIGH or worse. But a bug that only becomes useful *after* a separate browser exploit is materially less urgent for defenders managing patch queues across 10,000 hosts. Also, out-of-bounds read is usually a weaker primitive than direct write/UAF primitives for stable one-shot compromise.

Why not lower?

This still sits in the browser exploit-chain space, and Chrome is everywhere. If an attacker already has renderer code execution, a vulnerable cross-process graphics component is exactly the kind of second-stage primitive used to cross security boundaries, so this is not mere hygiene backlog.

1. Force browser auto-update compliance — Measure and enforce Chrome version drift through your endpoint management stack so stale builds are quickly flushed from the fleet. Because this is a MEDIUM verdict there is no mitigation SLA; use this as risk reduction while driving to the 365-day remediation window, not as an emergency workaround.
2. Keep Chrome sandbox and site isolation defaults intact — Do not relax browser hardening features for compatibility unless you have a tracked exception. The renderer-compromise prerequisite is the main friction keeping this CVE out of HIGH, so preserving the renderer boundary and process isolation is the most relevant defensive control while you patch.
3. Inventory unmanaged Chromium variants — Hunt for portable Chrome, developer channels, embedded Chromium runtimes, and lagging VDI gold images that fall outside the standard update ring. Medium-severity client CVEs linger longest in those pockets, and there is no mitigation SLA — go straight to the 365-day remediation window for cleanup if no active exploitation appears.
4. Watch for Chrome child-process crash clusters — Aggregate browser crash/telemetry from EDR, Windows Error Reporting, Linux coredumps, or macOS diagnostics to spot unusual renderer/GPU crash bursts tied to suspect sites. This will not prove exploitation, but it is one of the few defender-visible signals available for browser exploit-chain activity.

Run this on the target endpoint or through your software inventory agent. Invoke with python3 check_chrome_cve_2026_10889.py on Windows/macOS/Linux; no admin rights are required if Chrome is installed in standard user- or system-level locations. The script checks common Chrome/Chromium paths, extracts the local version, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_10889.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED_MIN = (149, 0, 7827, 53)
EXT_STABLE_WIN_MAC = (148, 0, 7778, 254)
ANDROID_FIXED = (149, 0, 7827, 59)  # documented for reference; this script is desktop-focused


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_str(v):
    return '.'.join(str(x) for x in v) if v else 'UNKNOWN'


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return 99, ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        pf = os.environ.get('PROGRAMFILES', '')
        pf86 = os.environ.get('PROGRAMFILES(X86)', '')
        candidates = [
            Path(local) / 'Google/Chrome/Application/chrome.exe',
            Path(pf) / 'Google/Chrome/Application/chrome.exe',
            Path(pf86) / 'Google/Chrome/Application/chrome.exe',
            Path(local) / 'Chromium/Application/chrome.exe',
            Path(pf) / 'Chromium/Application/chrome.exe',
            Path(pf86) / 'Chromium/Application/chrome.exe',
        ]
        for c in candidates:
            if c.exists():
                cmds.append([str(c), '--version'])

    elif system == 'darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
        ]
        for c in candidates:
            if Path(c).exists():
                cmds.append([c, '--version'])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            p = shutil.which(name)
            if p:
                cmds.append([p, '--version'])

    return cmds


def classify(version_tuple):
    major = version_tuple[0]

    # Windows/macOS Extended Stable backport documented at 148.0.7778.254
    if major == 148 and version_tuple >= EXT_STABLE_WIN_MAC:
        return 'PATCHED'

    if version_tuple >= FIXED_MIN:
        return 'PATCHED'

    return 'VULNERABLE'


def main():
    cmds = candidate_commands()
    if not cmds:
        print('UNKNOWN - Chrome/Chromium executable not found in common locations')
        sys.exit(2)

    seen = []
    for cmd in cmds:
        rc, out = run_cmd(cmd)
        v = parse_ver(out)
        seen.append((cmd[0], v, out))
        if v:
            state = classify(v)
            print(f'{state} - {cmd[0]} version {ver_str(v)}')
            sys.exit(0 if state == 'PATCHED' else 1)

    print('UNKNOWN - Found browser executable(s) but could not parse version')
    for path, v, out in seen:
        print(f'Checked: {path} | Raw: {out}')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop (2026-06-02)
2. Chrome Releases - Extended Stable Updates for Desktop (2026-06-03)
3. Chrome Releases - Chrome for Android Update (2026-06-02)
4. Chromium Security - Site Isolation
5. Chromium Security - chrome://sandbox Diagnostics for Windows
6. Chromium design doc - GPU accelerated compositing in Chrome
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS