Type Confusion in ANGLE in Google Chrome on Windows prior to 149

CVE-2026-10955 is a type confusion bug in ANGLE on Google Chrome for Windows. ANGLE is Chrome's graphics translation layer on Windows and sits on hot paths for WebGL and general rendering; Google states Chrome on Windows uses it for default WebGL handling and graphics rendering. Affected builds are Chrome on Windows before 149.0.7827.53; Google shipped fixes in the 149.0.7827.53/.54 stable train published on June 2, 2026, with an early stable rollout beginning May 29, 2026.

Reality check: this deserves HIGH, not panic-button critical. The attack is remote and drive-by via a crafted HTML page, which matters enormously at enterprise scale, but the public description stops at potential out-of-bounds memory access rather than confirmed code execution or sandbox escape, there is no KEV listing, no public exploit chain surfaced in web search, and Chrome's Windows sandbox is meaningful friction if the bug lands in a renderer-adjacent path.

Why this verdict

• Upward pressure: unauthenticated remote delivery — the attacker position is just 'internet + lure page'; no creds, no prior foothold, no local access.
• Upward pressure: ANGLE is hot-path code on Windows — Chromium documents ANGLE as the default WebGL backend and part of all graphics rendering on Windows, so this is not an edge feature few users ever touch.
• Downward pressure: user interaction + Windows-only scope + sandbox + no exploitation evidence — the chain needs page load, only hits Windows Chrome, and still has to overcome renderer/process containment to become a real host-compromise event.

Why not higher?

There is no public sign of exploitation, no public PoC, and the advisory language does not claim code execution or sandbox escape. In Chrome, those details matter: a memory bug inside a browser component is not automatically a full workstation takeover unless the exploit chain proves it.

Why not lower?

This is still a drive-by browser bug in a massively deployed enterprise client, reachable over the open web by simply getting a user to render attacker-controlled content. Even with the sandbox, that combination is too operationally important to bury in backlog hygiene.

1. Force Chrome auto-update compliance — Use your existing browser management stack to ensure Windows endpoints cannot sit indefinitely on pre-149.0.7827.53 builds. For a HIGH verdict, enforce this control within 30 days while patch rollout completes.
2. Constrain risky graphics paths where business-tolerable — For high-risk user tiers such as admins, finance, and helpdesk, consider temporarily disabling or restricting WebGL/GPU acceleration via enterprise policy if the business can tolerate it. This reduces reachability into ANGLE and should be deployed within 30 days on the highest-risk cohorts.
3. Isolate privileged browsing — Move privileged users and admin workflows to hardened browsing profiles, VDI, or browser isolation where available. This limits blast radius if a malicious page lands and should be in place within 30 days for your most sensitive users.
4. Turn browser crash telemetry into an alertable signal — Collect chrome.exe crash events, GPU-process instability, and repeated renderer failures into your SIEM/EDR detection pipeline. That won't prevent exploitation, but it gives you the only realistic early warning for a client-side browser flaw, and it should be operationalized within 30 days.

Run this on the target Windows endpoint or through your remote management tooling such as PowerShell Remoting/Intune. Invoke it with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10955.ps1; administrator rights are not required because it reads local file and registry metadata only.

# check-chrome-cve-2026-10955.ps1

# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-10955.

# Logic: Any installed Chrome version lower than 149.0.7827.53 is VULNERABLE.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param()

$ErrorActionPreference = 'SilentlyContinue'
$MinimumSafeVersion = [version]'149.0.7827.53'
$FoundVersions = New-Object System.Collections.Generic.List[version]

function Add-VersionIfValid {
    param([string]$VersionString)
    if ([string]::IsNullOrWhiteSpace($VersionString)) { return }
    try {
        $v = [version]$VersionString
        $FoundVersions.Add($v)
    } catch {
        # Ignore unparsable versions

    }
}

# Common Chrome executable paths

$Paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
) | Select-Object -Unique

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        $Item = Get-Item $Path
        if ($Item -and $Item.VersionInfo) {
            Add-VersionIfValid -VersionString $Item.VersionInfo.ProductVersion
            Add-VersionIfValid -VersionString $Item.VersionInfo.FileVersion
        }
    }
}

# Registry locations that may hold Chrome version metadata

$RegistryPaths = @(
    'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
    'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
    'HKCU:\Software\Google\Chrome\BLBeacon',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)

foreach ($RegPath in $RegistryPaths) {
    $Props = Get-ItemProperty -Path $RegPath
    if ($Props) {
        Add-VersionIfValid -VersionString $Props.version
        Add-VersionIfValid -VersionString $Props.pv
        if ($Props.'(default)') {
            $ExePath = $Props.'(default)'
            if (Test-Path $ExePath) {
                $Item = Get-Item $ExePath
                if ($Item -and $Item.VersionInfo) {
                    Add-VersionIfValid -VersionString $Item.VersionInfo.ProductVersion
                    Add-VersionIfValid -VersionString $Item.VersionInfo.FileVersion
                }
            }
        }
        if ($Props.Path) {
            $ExePath = Join-Path $Props.Path 'chrome.exe'
            if (Test-Path $ExePath) {
                $Item = Get-Item $ExePath
                if ($Item -and $Item.VersionInfo) {
                    Add-VersionIfValid -VersionString $Item.VersionInfo.ProductVersion
                    Add-VersionIfValid -VersionString $Item.VersionInfo.FileVersion
                }
            }
        }
    }
}

if ($FoundVersions.Count -eq 0) {
    Write-Output 'UNKNOWN - Chrome not found or version metadata unavailable'
    exit 2
}

$HighestVersion = $FoundVersions | Sort-Object -Descending | Select-Object -First 1

if ($HighestVersion -lt $MinimumSafeVersion) {
    Write-Output ("VULNERABLE - Detected Chrome version {0}; requires >= {1}" -f $HighestVersion, $MinimumSafeVersion)
    exit 1
} else {
    Write-Output ("PATCHED - Detected Chrome version {0}; meets minimum safe version {1}" -f $HighestVersion, $MinimumSafeVersion)
    exit 0
}

Sources

1. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. GitHub Advisory Database - GHSA-v8cp-r57p-rcv9 / CVE-2026-10955
4. NVD - CVE-2026-10955
5. ANGLE official repository README
6. Chromium - chrome://sandbox Diagnostics for Windows
7. Chromium - Multi-process Architecture
8. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544