CVE-2026-5283: Google Chrome Information Disclosure Flaw

CVE-2026-5283 Overview

CVE-2026-5283 affects Google Chrome versions prior to 146.0.7680.178. The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the abstraction layer that translates OpenGL ES calls into native graphics APIs across operating systems. An inappropriate implementation allows a remote attacker to leak cross-origin data through a crafted HTML page. Chromium classified the security severity as High, while NVD assigned a medium CVSS score reflecting the user interaction requirement. The flaw maps to CWE-285: Improper Authorization and breaks the same-origin policy enforcement that browsers rely on to isolate web content.

Critical Impact
A remote attacker can read cross-origin data rendered through ANGLE by luring a victim to a malicious HTML page, breaking browser origin isolation.

Affected Products

Google Chrome prior to 146.0.7680.178
Chromium-based browsers using ANGLE on Microsoft Windows, Apple macOS, and Linux
Embedded applications and frameworks that bundle vulnerable Chromium builds

Discovery Timeline

2026-04-01 - CVE-2026-5283 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5283

Vulnerability Analysis

The vulnerability lives in ANGLE, the graphics translation layer that Chrome uses to back WebGL and other GPU-accelerated web APIs. ANGLE converts OpenGL ES calls into Direct3D, Metal, or native OpenGL/Vulkan commands depending on the host operating system. An inappropriate implementation in this layer permits cross-origin data to be observed by a page that should not have access to it. The result is a same-origin policy bypass enabled through graphics rendering paths rather than the DOM.

The issue is categorized as improper authorization [CWE-285]. ANGLE fails to enforce origin boundaries on resources processed through the graphics pipeline. Attackers can use this to read pixel data, texture contents, or other render artifacts derived from cross-origin resources. Exploitation requires user interaction, specifically navigation to attacker-controlled content.

Root Cause

The root cause is missing or incorrect origin checks within ANGLE code paths that handle resources crossing security boundaries. When a renderer process composes graphics output that includes cross-origin material, ANGLE does not consistently restrict read-back or sampling operations. Web pages can therefore observe data from a different origin through carefully constructed GPU operations.

Attack Vector

Exploitation occurs over the network and requires the victim to load a crafted HTML page. The attacker hosts content that invokes specific ANGLE-backed rendering or sampling operations against cross-origin resources. Successful exploitation discloses confidential data from other origins, including authenticated content the victim has loaded in the same browser session. No privileges are required, and no additional Chrome flags need to be enabled.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor-supplied technical context.

Detection Methods for CVE-2026-5283

Indicators of Compromise

Chrome browser processes running versions earlier than 146.0.7680.178 after the patch release window
Outbound connections from user endpoints to unverified domains hosting WebGL or canvas-heavy content immediately preceding suspicious data exfiltration
Browser telemetry showing unusual chrome://gpu activity or repeated ANGLE renderer crashes correlated with web navigation

Detection Strategies

Inventory Chrome installations across endpoints and flag any build older than 146.0.7680.178 for remediation
Monitor web proxy logs for navigation to newly registered or low-reputation domains delivering complex WebGL payloads
Correlate browser process telemetry with DNS and HTTP egress to identify pages that trigger ANGLE-based rendering followed by exfiltration patterns

Monitoring Recommendations

Enforce browser version reporting through endpoint management and alert on out-of-date Chrome deployments
Track Chrome update channel compliance to confirm Stable channel rollouts complete within defined SLAs
Ingest browser and proxy logs into a centralized analytics platform to support cross-origin data leak hunts

How to Mitigate CVE-2026-5283

Immediate Actions Required

Update Google Chrome to version 146.0.7680.178 or later on Windows, macOS, and Linux endpoints
Force a restart of Chrome after the update so the new binaries load and ANGLE protections take effect
Audit Chromium-based applications and Electron builds for embedded Chromium versions and update accordingly

Patch Information

Google released the fix in Chrome 146.0.7680.178 through the Stable channel update documented in the Google Chrome Update Announcement. The patch corrects the ANGLE implementation so cross-origin resources are properly isolated during graphics operations. Administrators should distribute the update through enterprise management tooling and validate compliance via version reporting.

Workarounds

Restrict browsing to trusted sites through enterprise policy until patches are deployed
Disable hardware acceleration in Chrome as a temporary measure to reduce reliance on ANGLE rendering paths
Deploy strict Content Security Policy (CSP) headers on internally hosted applications to reduce the impact of cross-origin leaks

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enterprise policy: enforce automatic updates (Windows registry example)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f