Use after free in ANGLE in Google Chrome on Windows prior to 149

CVE-2026-10913 is a CWE-416 use-after-free in Chrome's ANGLE graphics layer on Windows, affecting Google Chrome versions before 149.0.7827.53. A remote attacker can deliver a crafted web page that triggers memory corruption and gains code execution, but the user-supplied title says that execution lands inside a sandbox, not at OS level.

paragraph 2: Google's 8.8/HIGH baseline is fair in a vacuum because it's a browser memory-safety bug reachable from the web with no auth, but it overstates enterprise urgency for *this CVE standing alone*. The decisive friction is that the achieved code runs in Chrome's constrained renderer/GPU isolation model on Windows, so this is not the same as full workstation takeover unless an attacker also has a sandbox escape or privilege-escalation chain.

Why this verdict

• Start from vendor 8.8/HIGH: network-reachable browser memory corruption with no privileges is always worth attention
• Downgrade for user interaction: the victim must browse to attacker content, which immediately narrows reachable population and gives web controls chances to stop delivery
• Downgrade again for sandboxed impact: the prompt's own description says code execution occurs *inside a sandbox*, which is a major practical brake on blast radius
• Downgrade for no exploitation signal: no KEV listing, no active-campaign evidence, and a very low EPSS remove the 'drop everything' pressure
• Hold at MEDIUM, not LOW, because Chrome is ubiquitous: a browser memory bug at fleet scale still matters, especially on unmanaged laptops, high-risk user groups, and internet-heavy roles

Why not higher?

If this were a confirmed sandbox escape, broker compromise, or a Chrome zero-day with active in-the-wild exploitation, it would jump fast. The available facts instead describe a single-stage browser bug whose achieved code execution remains contained by Chrome's Windows sandbox boundary.

Why not lower?

This is still a remotely delivered memory-safety flaw in one of the most widely deployed enterprise applications. At scale, even a sandboxed browser exploit can expose live session material, target high-value users, or serve as the first half of a chained intrusion.

1. Force rapid browser auto-update — Make sure Chrome enterprise policy is enforcing background updates and relaunch prompts so endpoints move off vulnerable builds without waiting for user behavior. For a MEDIUM verdict there is no mitigation SLA; use this as a hardening measure while you complete patching inside the 365-day remediation window.
2. Tighten risky web delivery paths — Reduce exploit delivery by hardening URL filtering, blocking newly registered domains where practical, and keeping browser Safe Browsing and anti-phishing controls fully enabled. There is no mitigation SLA for MEDIUM, but these controls are worth validating during the same remediation window because they cut exposure immediately.
3. Prioritize high-risk user rings — Patch first on administrator workstations, executives, researchers, help desk jump boxes, and users who browse untrusted content heavily. This is how you get real risk reduction fast even when the vuln itself does not justify an emergency fleet-wide outage.
4. Watch for crash and exploit telemetry — Correlate Chrome renderer/GPU crashes, exploit-guard events, and suspicious browser-child behavior in EDR. For a MEDIUM issue this is not a substitute for updating, but it gives you early signal if somebody is trying to operationalize the bug against your users.

Run this on the target Windows endpoint or through your EDR/management tool under a standard user context; admin is not required. Invoke with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10913.ps1 and it will inspect common Chrome install locations and report VULNERABLE, PATCHED, or UNKNOWN against the Windows fixed version 149.0.7827.53.

# check-chrome-cve-2026-10913.ps1

# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-10913

# Logic: Versions earlier than 149.0.7827.53 are VULNERABLE

# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = @(
        "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$Env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $reg = Get-ItemProperty -Path $rp
        if ($reg -and $reg.'(default)') {
            $paths += $reg.'(default)'
        }
        elseif ($reg -and $reg.Path) {
            $paths += (Join-Path $reg.Path 'chrome.exe')
        }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function Get-FileVersionString($path) {
    try {
        return (Get-Item $path).VersionInfo.ProductVersion
    }
    catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN: Google Chrome not found in standard locations.'
    exit 2
}

$results = @()
foreach ($chromePath in $candidates) {
    $verString = Get-FileVersionString $chromePath
    if (-not $verString) {
        $results += [pscustomobject]@{
            Path = $chromePath
            Version = $null
            State = 'UNKNOWN'
        }
        continue
    }

    try {
        $ver = [version]$verString
        $state = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
    }
    catch {
        $state = 'UNKNOWN'
    }

    $results += [pscustomobject]@{
        Path = $chromePath
        Version = $verString
        State = $state
    }
}

$results | ForEach-Object {
    Write-Output ("{0}: {1} ({2})" -f $_.State, $_.Path, ($_.Version ? $_.Version : 'version unreadable'))
}

if ($results.State -contains 'VULNERABLE') {
    exit 1
}
elseif ($results.State -contains 'PATCHED') {
    exit 0
}
else {
    exit 2
}

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Canadian Centre for Cyber Security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. FIRST EPSS data/API documentation
6. Chromium multi-process architecture
7. Chrome sandbox diagnostics for Windows
8. Chromium GPU accelerated compositing and GPU process design