Out of bounds write in ANGLE in Google Chrome prior to 149

CVE-2026-10907 is an out-of-bounds write in ANGLE, Chrome's graphics translation layer used by WebGL and other rendering paths. In practical terms, a malicious site can feed crafted graphics content into vulnerable Chrome builds and corrupt heap memory. Affected builds are Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS.

Google's HIGH / 8.8 label is technically defensible, but for enterprise patch triage it's a little hot. This is still a client-side, user-interaction-required browser bug with no KEV listing, no public in-the-wild evidence located, and no public PoC found as of 2026-06-05. The key reality check: browser memory corruption is dangerous, but the path from webpage to durable host compromise usually needs exploit reliability plus, often, a second stage beyond the initial browser process.

Why this verdict

• Downgrade for UI:R: the vendor baseline treats this like a broadly reachable remote bug, but every real attack still needs a user to render attacker content.
• Downgrade for chain friction: an ANGLE OOB write is dangerous, but turning browser heap corruption into stable endpoint impact usually needs a reliable exploit and often a second stage beyond the initial browser process.
• Downgrade for missing threat evidence: no KEV entry, no public campaign reporting, no public PoC, and a very low EPSS all push against emergency severity.
• Hold at HIGH for population size: Chrome is common across enterprise fleets, so even a click-driven client bug can have meaningful aggregate exposure if version hygiene is weak.

Why not higher?

There is no verified active exploitation, no public weaponization evidence, and the attack begins with a user opening malicious content. That is materially different from an externally reachable appliance flaw or a server RCE with immediate tenant-wide blast radius.

Why not lower?

This still lands through everyday browsing, requires no credentials, and targets one of the most ubiquitous applications in enterprise. Memory corruption in a browser is never housekeeping-grade risk, especially when privileged users and long browser session lifetimes are in play.

1. Force managed browser updates — Verify update channels, unpin stale versions, and use your browser management stack to push Chrome at or above the fixed build. For a HIGH verdict, do this under the mitigation intent within 30 days, even if the real fix is just the vendor update.
2. Isolate risky browsing tiers — Put admins, finance, executives, and help desk into remote browser isolation, disposable VDI, or hardened browsing profiles until coverage is complete. This is the best compensating control when you need a within-30-days risk reduction but cannot patch every endpoint immediately.
3. Disable WebGL where business-tolerable — If a user group does not need advanced browser graphics, restrict or disable WebGL/related GPU features through policy for that cohort. Use it as a temporary compensating control within 30 days, not as a permanent substitute for updating.
4. Watch version drift and crash telemetry — Alert on Chrome versions below the fixed floor and on spikes in browser/GPU-process crashes. This won't prevent exploitation, but it helps you find lagging rings and potential exploit testing during the 30-day mitigation window.

Run this on the target host or through your EDR/live-response tool. Invoke it as python3 check_cve_2026_10907.py on macOS/Linux or py check_cve_2026_10907.py on Windows; no admin rights are required. The script checks common Chrome/Chromium install locations and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_10907.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)

CANDIDATES = {
    'Windows': [
        r'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files\\Chromium\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Chromium\\Application\\chrome.exe',
    ],
    'Darwin': [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ],
    'Linux': [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
    ]
}


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    return tuple(map(int, m.groups())) if m else None


def version_str(v):
    return '.'.join(map(str, v))


def get_version_from_binary(path):
    try:
        out = subprocess.check_output([path, '--version'], stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out)
    except Exception:
        return None


def discover_binaries():
    system = platform.system()
    found = []

    for p in CANDIDATES.get(system, []):
        if os.path.exists(p):
            found.append(p)

    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = which(name)
        if p and p not in found:
            found.append(p)

    return found


def main():
    binaries = discover_binaries()
    if not binaries:
        print('UNKNOWN: no Chrome/Chromium binary found in common locations')
        sys.exit(2)

    results = []
    for b in binaries:
        v = get_version_from_binary(b)
        if v:
            results.append((b, v))

    if not results:
        print('UNKNOWN: Chrome/Chromium found, but version could not be determined')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver in results:
        if ver < FIXED:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        worst = min(v[1] for v in vulnerable)
        paths = ', '.join([f'{p} ({version_str(v)})' for p, v in vulnerable])
        print(f'VULNERABLE: found build(s) below {version_str(FIXED)} -> {paths}')
        sys.exit(1)

    best = max(v[1] for v in patched)
    paths = ', '.join([f'{p} ({version_str(v)})' for p, v in patched])
    print(f'PATCHED: all discovered build(s) are >= {version_str(FIXED)} -> {paths}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chrome 149 Release Notes
3. Canadian Centre for Cyber Security - Google Chrome Security Advisory AV26-544
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS Data Statistics
6. Chromium Security
7. Chromium Issue Tracker Entry 489071023