CVE-2026-10914

Google · Chrome

A Use-After-Free vulnerability in the ANGLE component of Google Chrome on Windows potentially allows an unauthenticated attacker to cause memory corruption.

Executive summary

A high-severity Use-After-Free vulnerability in Chrome's ANGLE component on Windows requires immediate patching to prevent potential unauthorized code execution.

Vulnerability

This is a Use-After-Free vulnerability within the ANGLE graphics engine. An unauthenticated remote attacker could exploit this by convincing a user to navigate to a malicious webpage, leading to a state where the browser uses freed memory, resulting in a system crash or arbitrary code execution.

Business impact

The CVSS score of 8.8 highlights the critical nature of this vulnerability. Organizations face risks of data compromise and unauthorized access if an attacker successfully exploits this flaw, as it allows for the subversion of the browser's security model.

Remediation

Immediate Action: Update all Windows installations of Chrome to version 149.0.7827.53/54 or later.

Proactive Monitoring: Review endpoint telemetry for suspicious browser activity or attempts to utilize graphics-related APIs in an unusual manner.

Compensating Controls: Utilize Group Policy or MDM solutions to enforce browser security policies and ensure that all users are running the latest patched version.

Exploitation status

Public Exploit Available: false

Analyst recommendation

Given the prevalence of Chrome in enterprise environments, this vulnerability necessitates an urgent patching cycle. Security teams should ensure that all Windows workstations are updated to the latest version to eliminate this security gap.