Use after free in ANGLE in Google Chrome prior to 150

ANGLE is Chrome's translation layer between WebGL/WebGPU calls and the host graphics stack (Direct3D on Windows, Metal on macOS, GL/Vulkan on Linux). A use-after-free in ANGLE means a maliciously crafted HTML page — one drive-by ad, one iframe, one embedded MP4 preview — can hand the attacker a dangling pointer inside the *GPU process*. The GPU process runs at a higher privilege tier than the renderer sandbox, so a bug here is the classic sandbox-escape primitive. Affected: all Chrome/Chromium-based browsers on Stable prior to 150.0.7871.46; expect Edge, Brave, Opera, Vivaldi, and Electron apps to inherit until they respin.

Google's 9.6 CRITICAL is defensible on paper — network attack vector, low complexity, scope-changed to SYSTEM-tier impact. In practice, ANGLE UAFs are almost always half of a chain: you still need a renderer RCE first to reach the ANGLE IPC surface, or a *very* creative WebGL primitive that bypasses Chrome's Site Isolation. That makes the real-world severity closer to HIGH unless and until a public one-click exploit lands, which is why we downshift from 9.6 to 8.4.

Why this verdict

• No active exploitation: Google's advisory lacks the 'exists in the wild' marker; not on KEV. That's the single biggest downshift from 9.6.
• User interaction required: UI:R — the victim must load attacker content. Not wormable, not driveable by a Shodan scan.
• Chain-dependent in practice: an ANGLE UAF alone is a sandbox-escape *half*. Weaponization needs either a renderer RCE or a WebGL primitive that reaches GPU-process IPC without a renderer bug — non-trivial.
• Role multiplier — endpoint browsers: Chain succeeds in typical role (user workstation) with blast radius = single-user credential theft + cookie exfil. Not fleet-scale on its own, but multiplied across a 10k-host fleet the aggregate risk is meaningful → HIGH is the floor, not MEDIUM.
• Role multiplier — jump hosts / admin workstations: If admins browse from PAWs or jump hosts running Chromium, a successful chain gives an attacker session tokens for Azure AD, AWS console, GitHub — that is the fleet-scale path and it prevents any downgrade below HIGH.
• Auto-update reduces blast radius fast: Chrome's silent updater closes exposure within 24-72h on unmanaged installs. The exposed population is your *pinned/managed* fleet, which is smaller but slower to patch.

Why not higher?

CRITICAL is reserved for bugs with public PoC, active exploitation, or unauthenticated RCE without user interaction. This one requires visiting attacker content, has no public exploit at disclosure, and is almost always chained rather than standalone — the vendor 9.6 reflects the theoretical worst case, not observed reality on day one.

Why not lower?

MEDIUM would ignore that the affected component is on ~90% of your endpoints, that GPU-process escape is a real primitive Google has paid four- and five-figure bounties for, and that admin browsing sessions are a fleet-scale credential-theft vector. The role multiplier on admin/PAW browsers alone floors this at HIGH.

1. Force Chrome Stable to 150.0.7871.46 via GPO / MDM — Use the ChromiumUpdateOverride / Google Update AutoUpdateCheckPeriodMinutes policy to force an update check now rather than waiting for the default 5-hour poll. On macOS use Jamf/Kandji Chrome config profile; on Windows use the Chrome Enterprise ADMX. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Kill pinned browser versions — Audit your fleet for Chrome/Chromium/Edge/Brave versions pinned by app-compat exceptions. Those hosts are your exposure. Sweep and unpin within 30 days; for Electron apps, push vendor updates on the same clock.
3. Enforce Site Isolation and disable legacy WebGL fallbacks — Set SitePerProcess=Enabled and WebGL2Enabled policies to control the attack surface. For very sensitive fleets (admin PAWs, DFIR workstations) set Disable3DAPIs=1 to remove ANGLE reachability entirely until patched.
4. Tighten browser egress on admin workstations — Jump hosts, PAWs, and Tier-0 admin endpoints should only reach a documented allowlist of cloud consoles. This limits the malvertising/drive-by delivery surface for the users whose credential theft would hurt most.
5. Turn on Chrome Enterprise reporting connector — Ship crash and safe-browsing signals to your SIEM. GPU-process crashes at anomalous rates on a single host are one of the few in-the-wild indicators you'll get before public IOCs land.

Run on each Windows endpoint (via SCCM, Intune Proactive Remediations, or Invoke-Command from an auditor workstation). Requires standard user rights to read the installed Chrome version. Example: powershell -ExecutionPolicy Bypass -File Check-CVE-2026-14425.ps1.

# Check-CVE-2026-14425.ps1
# Detects Chrome installs vulnerable to CVE-2026-14425 (ANGLE UAF)
# Fixed in Chrome 150.0.7871.46 (Windows/Mac), 150.0.7871.44 (Linux)
# Output: VULNERABLE / PATCHED / UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$FIXED = [Version]'150.0.7871.46'

$paths = @(
  "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
  "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
  "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe",
  "$env:ProgramFiles\Microsoft\Edge\Application\msedge.exe",
  "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe",
  "$env:ProgramFiles\BraveSoftware\Brave-Browser\Application\brave.exe"
) | Where-Object { Test-Path $_ }

if (-not $paths) {
  Write-Output 'UNKNOWN: no Chromium-family browser found'
  exit 2
}

$verdict = 'PATCHED'
foreach ($p in $paths) {
  try {
    $ver = (Get-Item $p).VersionInfo.ProductVersion
    $v   = [Version]($ver -replace '[^\d\.].*$','')
    $tag = if ($v -lt $FIXED) { 'VULNERABLE' } else { 'PATCHED' }
    Write-Output "$tag`t$p`t$ver"
    if ($tag -eq 'VULNERABLE') { $verdict = 'VULNERABLE' }
  } catch {
    Write-Output "UNKNOWN`t$p`t$($_.Exception.Message)"
    if ($verdict -ne 'VULNERABLE') { $verdict = 'UNKNOWN' }
  }
}

switch ($verdict) {
  'VULNERABLE' { exit 1 }
  'PATCHED'    { exit 0 }
  default      { exit 2 }
}

Sources

1. Chrome Releases blog (Stable channel updates)
2. Chrome Enterprise policy list
3. Chromium bug tracker / ANGLE component
4. CISA KEV catalog
5. FIRST EPSS scoring
6. Microsoft Edge security release notes
7. Chromium Site Isolation design
8. Related — CVE-2026-10881 ANGLE analysis