CVE-2026-10914
Google · Chrome
A Use-After-Free vulnerability in the ANGLE component of Google Chrome on Windows potentially allows an unauthenticated attacker to cause memory corruption.
Executive summary
A high-severity Use-After-Free vulnerability in Chrome's ANGLE component on Windows requires immediate patching to prevent potential unauthorized code execution.
Vulnerability
This is a Use-After-Free vulnerability within the ANGLE graphics engine. An unauthenticated remote attacker could exploit this by convincing a user to navigate to a malicious webpage, leading to a state where the browser uses freed memory, resulting in a system crash or arbitrary code execution.
Business impact
The CVSS score of 8.8 highlights the critical nature of this vulnerability. Organizations face risks of data compromise and unauthorized access if an attacker successfully exploits this flaw, as it allows for the subversion of the browser's security model.
Remediation
Immediate Action: Update all Windows installations of Chrome to version 149.0.7827.53/54 or later.
Proactive Monitoring: Review endpoint telemetry for suspicious browser activity or attempts to utilize graphics-related APIs in an unusual manner.
Compensating Controls: Utilize Group Policy or MDM solutions to enforce browser security policies and ensure that all users are running the latest patched version.
Exploitation status
Public Exploit Available: false
Analyst recommendation
Given the prevalence of Chrome in enterprise environments, this vulnerability necessitates an urgent patching cycle. Security teams should ensure that all Windows workstations are updated to the latest version to eliminate this security gap.