Use after free in ANGLE in Google Chrome prior to 149

CVE-2026-11065 is a use-after-free bug in Chrome's ANGLE graphics layer, fixed in Chrome 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS. The supplied CVE text says the bug only matters after an attacker has already compromised the renderer process, which makes this a *sandbox-escape stage* in a browser exploit chain rather than a standalone initial-access bug.

The vendor-style 9.6/CRITICAL label does not match field reality. Google's own June 2, 2026 stable release post classifies CVE-2026-11065 as Medium, and that is the right anchor: the decisive friction is the prerequisite of a separate renderer exploit first, which sharply narrows reachable attackers, affected sessions, and practical exploit volume despite the scary worst-case impact once chained.

Why this verdict

• Renderer compromise required: starting from the supplied 9.6 baseline, the biggest downward adjustment is that the attacker must already own the renderer first. That implies a prior exploit stage succeeded, which massively narrows who can actually use this bug.
• Client-side and non-scannable: Chrome is everywhere, but this is not a remotely reachable service you can sweep from the internet. Reachability depends on user browsing plus exploit-chain quality, which cuts practical abuse volume.
• No exploitation evidence: no KEV listing, no zero-day language from Google, and a very low supplied EPSS score all push urgency down further.
• Google itself scored it Medium: when Google's release notes and downstream CVSS-style metadata disagree, the vendor's product-context severity is usually the better guide for browser chain bugs like this.

Why not higher?

It is not higher because this CVE is not a standalone initial-access event. A bug that requires prior renderer compromise is, by definition, a second-stage exploit component whose real-world population is smaller than a true unauthenticated remote code execution flaw.

Why not lower?

It is not lower because sandbox-escape primitives in Chrome still matter a lot when they *do* chain cleanly. Chrome is widely deployed, ANGLE sits on a security-sensitive graphics path, and a working exploit would materially raise attacker payoff from a renderer foothold.

1. Keep Chrome auto-update unblocked — Make sure update policies, version pinning, and software-distribution rings are not freezing browsers below 149.0.7827.53. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but fixing broken update channels should happen in normal browser hygiene immediately because it reduces exposure to the whole Chrome bug bundle, not just this CVE.
2. Restrict unnecessary WebGL/GPU access where feasible — On high-risk kiosks, VDI pools, and tightly managed admin workstations, consider temporarily reducing unneeded graphics exposure if business workflows allow it. This is a niche compensating control only; there is no noisgate mitigation SLA for MEDIUM, so use it selectively while patching inside the 365-day remediation window.
3. Hunt for Chrome crash clusters — Pull browser and EDR telemetry for repeated renderer/GPU-process crashes, especially ANGLE- or libGLESv2-related faults, because exploit development against lifetime bugs is noisy before it is reliable. Do this in routine monitoring; again, there is no noisgate mitigation SLA for MEDIUM unless active exploitation emerges.
4. Focus exceptions on frozen images — Audit VDI, kiosk, gold-image, and offline endpoints where Chrome auto-update is commonly disabled or delayed. Those populations are where a Medium browser CVE quietly turns into long-lived exposure over the 365-day remediation window.

Run this on the target endpoint or through your software-distribution/endpoint-management tooling. Invoke it with python3 check_chrome_cve_2026_11065.py on macOS/Linux or py check_chrome_cve_2026_11065.py on Windows; no admin rights are required unless your EDR blocks process inspection.

#!/usr/bin/env python3
# check_chrome_cve_2026_11065.py
# Detects whether local Google Chrome is below the fixed version for CVE-2026-11065.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(path):
    try:
        p = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=5)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def candidates():
    system = platform.system()
    paths = []
    if system == 'Windows':
        for envvar in ('PROGRAMFILES', 'PROGRAMFILES(X86)', 'LOCALAPPDATA'):
            base = os.environ.get(envvar)
            if base:
                paths.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    elif system == 'Darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
    else:
        for name in ('google-chrome', 'google-chrome-stable', 'chrome'):
            found = shutil.which(name)
            if found:
                paths.append(found)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/chrome',
        ])

    seen = []
    unique = []
    for p in paths:
        if p not in seen:
            seen.append(p)
            unique.append(p)
    return unique


def main():
    found_any = False
    for path in candidates():
        if not os.path.exists(path) and not shutil.which(path):
            continue
        ver = run_version(path)
        if ver is None:
            continue
        found_any = True
        print(f'FOUND: {path}')
        print('VERSION: %d.%d.%d.%d' % ver)
        print('FIXED_AT: %d.%d.%d.%d' % FIXED)
        if ver >= FIXED:
            print('PATCHED')
            sys.exit(0)
        else:
            print('VULNERABLE')
            sys.exit(1)

    if not found_any:
        print('UNKNOWN')
        print('Google Chrome not found or version could not be determined.')
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases - 2026 archive
3. Chromium issue 499093536
4. Chromium Security Page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Chrome Enterprise - Manage Chrome updates (Windows)