CVE-2026-14386: Google Chrome ANGLE Info Disclosure Flaw

CVE-2026-14386 Overview

CVE-2026-14386 is an out-of-bounds read vulnerability [CWE-125] in ANGLE, the graphics translation layer used by Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.46. A remote attacker can exploit the issue by convincing a user to visit a crafted HTML page. Successful exploitation allows the attacker to read potentially sensitive information from Chrome process memory. Chromium classifies the security severity as High, while the assigned CVSS score reflects information disclosure without integrity or availability impact.

Critical Impact
Remote attackers can leak sensitive data from the Chrome renderer process memory through a crafted web page, exposing browser session data, tokens, or cross-origin content fragments.

Affected Products

Google Chrome versions prior to 150.0.7871.46
Chromium-based browsers integrating the vulnerable ANGLE component
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-07-01 - CVE-2026-14386 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14386

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the abstraction layer that translates OpenGL ES API calls into the native graphics API of the host platform. ANGLE handles WebGL rendering in Chrome and processes untrusted graphics commands originating from web content.

An out-of-bounds read occurs when ANGLE processes data structures whose size or offset is not properly validated against the boundaries of an allocated buffer. The read reaches beyond the intended memory region and returns adjacent process memory to the caller. Because ANGLE runs inside the renderer or GPU process, the leaked bytes may contain sensitive material such as authentication tokens, cross-origin resource fragments, or pointers useful for further exploit development.

The issue carries an EPSS probability of 0.232%, indicating low observed exploitation activity at publication.

Root Cause

The root cause is missing or insufficient bounds checking within an ANGLE code path that handles attacker-controllable graphics inputs. When the code reads from a buffer using an index or length derived from untrusted content, it fails to verify that the access remains within the allocated region. The result is a read past the buffer boundary that returns uninitialized or unrelated memory contents to code paths reachable from JavaScript through WebGL.

Attack Vector

Exploitation requires network-based delivery and user interaction. The attacker hosts a crafted HTML page containing malicious WebGL or graphics-related JavaScript. When a victim visits the page in an unpatched Chrome build, the page triggers the vulnerable ANGLE code path and extracts memory contents. The attacker can then transmit the leaked data back through standard web channels. No privileges are required on the target system.

The vulnerability is described in prose only because no verified public exploit code exists. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-14386

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.46 on managed endpoints
Renderer or GPU process crashes correlated with WebGL activity on untrusted origins
Outbound requests immediately following WebGL-heavy page loads that carry unexpectedly structured payloads

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.46 as vulnerable
Monitor endpoint telemetry for chrome.exe GPU process anomalies triggered by graphics API calls from newly seen domains
Correlate browsing history with threat intelligence feeds to identify visits to pages hosting known exploit content

Monitoring Recommendations

Enable browser management policies that report installed versions to a central inventory
Ingest Chrome crash telemetry and Windows Error Reporting events into the security data lake for retrospective hunting
Alert on execution of unexpected child processes spawned by Chrome renderer processes after graphics-heavy page loads

How to Mitigate CVE-2026-14386

Immediate Actions Required

Update Google Chrome to version 150.0.7871.46 or later on all endpoints
Restart Chrome after the update to ensure the patched ANGLE library is loaded
Apply equivalent updates to Chromium-based browsers such as Microsoft Edge, Brave, and Opera when vendor patches are released

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release announced in the Google Chrome Update Announcement. Administrators should deploy 150.0.7871.46 or newer through enterprise update mechanisms such as Chrome Browser Cloud Management, Group Policy, or MDM configuration profiles.

Workarounds

Disable WebGL through enterprise policy (HardwareAccelerationModeEnabled = false) until patching completes
Restrict access to untrusted external websites using web filtering or DNS-based controls
Deploy site isolation and enforce strict per-site process separation to limit the scope of any leaked memory

bash

# Configuration example: enforce minimum Chrome version via policy on Windows
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.46" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f