Integer overflow in ANGLE in Google Chrome on Windows prior to 149

CVE-2026-10999 affects Google Chrome on Windows before 149.0.7827.53. The user-supplied title calls it an *integer overflow in ANGLE*, but Google's June 2, 2026 desktop release notes currently describe CVE-2026-10999 as a Medium-severity out-of-bounds memory access in ANGLE, reported on 2026-03-04. Either way, this lives in Chrome's graphics translation layer on Windows, not in a server-facing service, and it only matters on endpoints running vulnerable Chrome builds.

The vendor's MEDIUM 6.5 already looks too generous for enterprise patch triage once you apply real-world friction. The decisive issue is the prerequisite: the attack path assumes a previous renderer compromise or equivalent malicious code execution in the renderer context. In Chrome's own security model, a compromised renderer is already a post-exploitation state, and this bug is at best a follow-on primitive for a larger chain, not an initial foothold.

Why this verdict

• Major downgrade: requires a compromised renderer first — that implies the attacker is already past the first defensive layer and already executing inside Chrome's sandboxed content process.
• Population narrows hard — this is Windows-only Chrome, not a cross-platform internet-facing service, and exploitation likely depends on GPU/driver/path specifics in ANGLE.
• No active exploitation signal — not KEV-listed, very low EPSS, and no public PoC found, so there is no evidence of broad operational use right now.

Why not higher?

A higher severity would require either broad pre-auth reachability, active exploitation, or a clear path to meaningful impact from the CVE by itself. We do not have that here. The prerequisite chain is too restrictive: remote content delivery alone is insufficient without first burning a separate renderer exploit.

Why not lower?

This is still a memory-safety flaw in a massively deployed browser component, and browser-chain operators do care about these bugs. If you run large unmanaged Windows fleets or lag Chrome updates, the ubiquity of the target keeps it above pure ignore territory.

1. Force Chrome auto-update compliance — Use enterprise browser management or endpoint tooling to confirm Windows Chrome clients reach 149.0.7827.53 or later. For a LOW verdict there is no SLA for temporary mitigation; treat this as backlog hygiene and drive compliance through the normal remediation window.
2. Prioritize unmanaged Windows browsers — Focus on developer workstations, kiosk systems, VDI gold images, and exception hosts where Chrome may lag behind central policy. These tend to be the pockets where browser-chain risk survives longest; clear them during the normal LOW remediation cycle.
3. Watch for browser crash clusters — Correlate EDR, Windows Error Reporting, and browser telemetry for spikes in chrome.exe or GPU-process crashes after web browsing activity. This will not prove exploitation, but it is one of the few practical ways to spot instability in graphics-path bugs before patch coverage is complete.
4. Harden the first-stage path — Because this CVE is chain-dependent, reduce exposure to stage-1 renderer bugs with Safe Browsing, exploit protection, browser isolation for high-risk users, and rapid browser patching generally. For LOW, fold these checks into existing control maintenance rather than launching a dedicated emergency change.

Run this on the target Windows endpoint or through your EDR/remote PowerShell at user or admin level; admin is not required unless your tooling restricts file access. Example: powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10999.ps1 or remotely through your fleet tool. The script checks common Chrome install paths and reports VULNERABLE, PATCHED, or UNKNOWN based on whether any detected Chrome version is below 149.0.7827.53.

# check-chrome-cve-2026-10999.ps1

# Purpose: Detect whether Google Chrome on Windows is vulnerable to CVE-2026-10999

# Logic: Any detected chrome.exe version < 149.0.7827.53 => VULNERABLE

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-ChromeCandidates {
    $paths = @(
        "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$Env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $results = @()
    foreach ($p in $paths) {
        if ($p -and (Test-Path $p)) {
            $results += $p
        }
    }

    # Optional registry discovery for nonstandard paths

    $regKeys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rk in $regKeys) {
        $val = (Get-ItemProperty -Path $rk -Name '(default)').'(default)'
        if ($val -and (Test-Path $val)) {
            $results += $val
        }
    }

    return $results | Sort-Object -Unique
}

function Get-FileVersionString($path) {
    try {
        return (Get-Item $path).VersionInfo.FileVersion
    } catch {
        return $null
    }
}

function Normalize-Version($v) {
    if (-not $v) { return $null }
    $clean = ($v -split '\s+')[0].Trim()
    try {
        return [version]$clean
    } catch {
        return $null
    }
}

$fixedVersion = [version]'149.0.7827.53'
$candidates = Get-ChromeCandidates

if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN - chrome.exe not found in common paths or registry'
    exit 2
}

$foundAny = $false
$foundVulnerable = $false
$messages = @()

foreach ($exe in $candidates) {
    $rawVersion = Get-FileVersionString $exe
    $ver = Normalize-Version $rawVersion

    if ($ver) {
        $foundAny = $true
        if ($ver -lt $fixedVersion) {
            $foundVulnerable = $true
            $messages += "VULNERABLE - $exe - version $ver is below $fixedVersion"
        } else {
            $messages += "PATCHED - $exe - version $ver meets/exceeds $fixedVersion"
        }
    } else {
        $messages += "UNKNOWN - $exe - could not parse version string '$rawVersion'"
    }
}

$messages | ForEach-Object { Write-Output $_ }

if ($foundVulnerable) {
    Write-Output 'VULNERABLE'
    exit 1
}

if ($foundAny) {
    Write-Output 'PATCHED'
    exit 0
}

Write-Output 'UNKNOWN - no parsable Chrome versions found'
exit 2

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (2026-06-02)
2. Google Chrome Releases - Stable updates label search showing CVE-2026-10999
3. Chromium docs - Threat Model And Defenses Against Compromised Renderers
4. Chromium - Site Isolation
5. Chromium - Chrome sandbox diagnostics for Windows
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. VulDB entry for CVE-2026-10999