Use after free in ANGLE in Google Chrome prior to 149

CVE-2026-10919 is a use-after-free in ANGLE, Chrome’s graphics translation layer, affecting Google Chrome versions prior to 149.0.7827.53. The key qualifier is in the vendor wording: the attacker must have already compromised the renderer process and then use a crafted HTML page to try to escape Chrome’s sandbox. In plain English, this is not the phishing-click-to-full-host-compromise bug by itself; it is the second-stage breakout that turns a renderer foothold into something more dangerous.

Google’s HIGH 8.3 label overstates the operational urgency for enterprise patch triage because it scores the technical impact once the bug is reachable, not the real-world friction to reach it. The decisive downgrade is the prerequisite chain: user interaction + a separate renderer compromise + successful exploit reliability inside a modern sandboxed browser. That keeps this important for browser hygiene, but it is not the kind of naked remote edge exploit that should jump ahead of actively exploited internet-facing flaws.

Why this verdict

• Downgrade for attacker position: this is not unauthenticated remote code execution by itself; the attacker must first compromise the renderer, which implies an earlier successful exploit stage.
• Downgrade for exposed population: every Chrome endpoint may carry the vulnerable code, but only the subset facing a working renderer exploit chain is actually reachable for this CVE.
• Downgrade for defensive friction: modern Chrome sandboxing, Site Isolation, exploit mitigations, and EDR raise the failure rate from ‘memory bug exists’ to ‘reliable host impact achieved’.
• Hold at MEDIUM, not LOW: Chrome is massively deployed, ANGLE is security-relevant, and a sandbox escape is high-value to advanced exploit chains even when it is not independently reachable.
• No threat amplifier present: no KEV listing, no known public PoC, and no public in-the-wild evidence were found to justify keeping the vendor’s HIGH operational priority.

Why not higher?

A higher rating would require at least one major amplifier: active exploitation, KEV listing, a public reliable PoC, or direct unauthenticated remote reachability. None are present here. The need for a separate renderer compromise is compounding downward pressure because it assumes the attacker has already cleared the hardest browser exploitation step.

Why not lower?

This is still a sandbox escape in Chrome, not harmless crashware. In environments facing targeted browser exploitation, second-stage escapes are exactly what turns a renderer bug into meaningful host impact, so backlog-only treatment would understate the risk.

1. Enforce browser auto-update — Make sure managed Chrome channels cannot sit below 149.0.7827.53 indefinitely. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should still ride normal rapid-update policy rather than discretionary user timing.
2. Reduce unmanaged browsing — Push users into enterprise-managed Chrome profiles and remove stale side-installed browser copies where possible. This matters because exposure is inventory-driven; for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.
3. Harden browser exploit surface — Keep Site Isolation, EDR exploit prevention, and OS/browser hardening fully enabled to make renderer-to-sandbox chains less reliable. These are containment controls, not substitutes for patching; for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.
4. Watch for browser-child anomalies — Tune EDR for suspicious browser process trees, crash bursts, and unexpected broker or child-process behavior. This helps catch exploit-chain execution while you work through the normal remediation cycle; for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.

Run this on the target endpoint or through your software inventory tooling. Invoke with python3 check_chrome_cve_2026_10919.py on macOS/Linux or py check_chrome_cve_2026_10919.py on Windows; no admin rights are required as long as the Chrome binary is readable in standard install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_10919.py
# Detects whether Google Chrome is vulnerable to CVE-2026-10919 based on version.
# Vulnerable: versions prior to 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out)
    except Exception:
        return None


def check_windows() -> Optional[Tuple[int, int, int, int]]:
    paths = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for p in paths:
        if p and os.path.exists(p):
            v = run_version([p, '--version'])
            if v:
                return v
    if shutil.which('chrome'):
        return run_version(['chrome', '--version'])
    return None


def check_macos() -> Optional[Tuple[int, int, int, int]]:
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for p in paths:
        if os.path.exists(p):
            v = run_version([p, '--version'])
            if v:
                return v
    return None


def check_linux() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        'google-chrome',
        'google-chrome-stable',
        '/opt/google/chrome/chrome',
        'chromium',
        'chromium-browser',
    ]
    for c in candidates:
        path = shutil.which(c) if not c.startswith('/') else c
        if path and os.path.exists(path):
            v = run_version([path, '--version'])
            if v:
                return v
    return None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version = check_windows()
    elif 'darwin' in system:
        version = check_macos()
    else:
        version = check_linux()

    if not version:
        print('UNKNOWN - Google Chrome not found or version unreadable')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if version < FIXED:
        print(f'VULNERABLE - detected Chrome {version_str}; fixed version is {fixed_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - detected Chrome {version_str}; fixed threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chromium - Site Isolation overview
3. Chromium - Site Isolation design document
4. Chromium source - Sandbox design
5. ANGLE project README
6. CISA Known Exploited Vulnerabilities Catalog
7. Chromium Security - Memory safety
8. Chromium Security landing page