Threat reportVulnerabilityTL-2026-0720
Google Chrome 149.0.7827.53 — 429 Vulnerabilities Patched (22 Critical); Critical ANGLE/GPU Memory-Safety Sandbox-Escape Chain (CVE-2026-10881 / CVE-2026-10883 / CVE-2026-10898)
Google Chrome 149.0.7827.53 (TL-2026-0720), also tracked as Chrome 149.0.7827.53 Stable, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-06-08. It has no confirmed attribution, affects Google Chrome (Desktop), references 3 CVEs (CVE-2026-10881, CVE-2026-10883, CVE-2026-10898), maps to 12 MITRE ATT&CK techniques (T1005, T1055, T1068), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-0720
- Threat ID
- TL-2026-0720
- Also known as
- Chrome 149.0.7827.53 Stable, Chrome 149 June 2026 Security Update
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- all sectors, government, financial, healthcare, technology, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
How Google Chrome 149.0.7827.53 works
Google shipped Chrome stable 149.0.7827.53 (Windows, macOS, Linux, iOS) fixing 429 vulnerabilities, 22 rated critical. The standout criticals are renderer-reachable memory-safety defects in ANGLE and the GPU process — an out-of-bounds read/write (CVE-2026-10881, CVSS 9.6) and type confusion (CVE-2026-10883) in ANGLE, and a GPU stack buffer overflow (CVE-2026-10898) — that chain crafted-HTML renderer compromise into GPU-process sandbox escape.
On 2026-06-04 Google promoted Chrome 149.0.7827.53 to the stable channel across Windows, macOS, Linux and Chrome for iOS, resolving 429 distinct security defects, 22 of which carry Chromium 'Critical' severity. The release is dominated by memory-safety bugs in the graphics and GPU paths, all reachable from untrusted web content rendered in a tab.
CVE-2026-10881 is an out-of-bounds read and write in ANGLE (Almost Native Graphics Layer Engine), Chrome's OpenGL ES translation layer that backs WebGL and WebGPU. A crafted HTML page driving malformed graphics state triggers OOB access within the GPU process, which ANGLE runs inside. NVD scores it CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) with a CHANGED scope, reflecting that successful exploitation crosses the renderer/GPU sandbox boundary toward a sandbox escape (CWE-125, CWE-787).
CVE-2026-10883 is a type confusion in ANGLE leading to heap corruption (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Conflating one object type for another inside the GPU process gives an attacker controlled read/write primitives over the heap — a classic stepping stone toward arbitrary code execution in the GPU process.
CVE-2026-10898 is a stack buffer overflow in the GPU component (CVSS 8.3, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-121). NVD's description is explicit that it requires an attacker who has 'already compromised the renderer process' and then performs a sandbox escape via a crafted HTML page — i.e. it is the back half of a two-stage chain in which a renderer bug (such as a V8 or DOM use-after-free) is paired with a GPU-process memory-safety bug to break out of the sandbox.
Beyond the three headline ANGLE/GPU criticals, the patch set closes a broad sweep of use-after-free conditions across Network, Chromecast, Cast Streaming, Chromoting (Chrome Remote Desktop), Printing, FileSystem, GFX and Ozone, plus the iOS WebKit-adjacent layer; high-severity type confusion and implementation bugs in V8; use-after-free in WebRTC, WebAuthentication, Audio and UI; and integer overflows in Dawn (WebGPU backend), DevTools, and Media. Google is withholding detailed bug-tracker entries and restricting access to the bug details until a majority of users have updated, per its standard disclosure embargo.
At time of analysis there is no confirmed in-the-wild exploitation and no public proof-of-concept for the three tracked CVEs. However, ANGLE and GPU-process memory-safety bugs are a historically favored target for browser exploit chains because the GPU process is less hardened than the renderer and sits adjacent to the OS graphics stack. The combination of network attack vector, no privileges required, and only user interaction (visiting a page) makes these prime candidates for weaponization once details or patches are diffed.
MITRE ATT&CK techniques used in TL-2026-0720
Collection
Defense Evasion
T1055 Process Injection; T1211 Exploitation for Stealth
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Command and Control
Initial Access
Execution
T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link
Resource Development
T1587.004 Develop Capabilities: Exploits; T1608.004 Stage Capabilities: Drive-by Target
Reconnaissance
Affected products and versions in Google Chrome 149.0.7827.53
- Google — Chrome (Desktop)
Vulnerable versions: < 149.0.7827.53 (Windows); < 149.0.7827.53 (macOS); < 149.0.7827.53 (Linux)
Fixed in: 149.0.7827.53 - Google — Chrome for iOS
Vulnerable versions: < 149.0.7827.53
Fixed in: 149.0.7827.53 - Google — ANGLE / GPU process
Vulnerable versions: as shipped in Chrome < 149.0.7827.53
Fixed in: 149.0.7827.53 - Chromium — Chromium-derived browsers and Electron apps
Vulnerable versions: builds based on Chromium < 149.0.7827.53
Fixed in: downstream rebuilds pending
Remediation for Google Chrome 149.0.7827.53
Patches
- Google Chrome 149.0.7827.53 (Stable channel, all desktop platforms)
- Chrome for iOS 149.0.7827.53
- Pending Chromium-derived rebuilds (Microsoft Edge, Brave, Vivaldi, Opera, Electron)
Immediate actions
- Update Chrome to 149.0.7827.53 or later on Windows, macOS and Linux (chrome://settings/help then relaunch).
- Update Chrome for iOS to 149.0.7827.53 via the App Store.
- Force-relaunch browsers across the fleet to apply the staged update; do not rely on lazy background updates.
Workarounds
- Temporarily disable hardware acceleration (chrome://settings -> System) to reduce ANGLE/GPU attack surface where immediate patching is not possible.
- Restrict WebGL/WebGPU via enterprise policy for high-risk user groups until patched.
Longer-term hardening
- Deploy enterprise update policy (RelaunchNotification / RelaunchNotificationPeriod) to enforce timely Chrome restarts.
- Enable Site Isolation and ensure GPU sandboxing is not disabled by managed flags.
- Inventory Chromium-derived software (Electron apps, Edge, Brave, Chromecast/Cast firmware) and track their downstream patch uptake.
CVEs associated with Google Chrome 149.0.7827.53
Weaknesses (CWE) in Google Chrome 149.0.7827.53
Timeline of Google Chrome 149.0.7827.53
- Chrome CVE numbering authority publishes CVE-2026-10881, CVE-2026-10883 and CVE-2026-10898 covering the ANGLE/GPU memory-safety criticals.
- Google promotes Chrome 149.0.7827.53 to the stable channel for Windows, macOS, Linux and iOS, fixing 429 vulnerabilities (22 critical).
- NVD completes analysis: CVE-2026-10881 scored CVSS 9.6 (sandbox escape), CVE-2026-10883 CVSS 8.8 (heap corruption), CVE-2026-10898 CVSS 8.3 (GPU sandbox escape from compromised renderer).
- Status ACTIVE pending downstream Chromium rebuilds (Edge, Brave, Vivaldi, Opera, Electron) and possible patch-diff weaponization.
- Threadlinqs intake: triaged as renderer-reachable sandbox-escape chain candidate; no confirmed in-the-wild exploitation or public PoC at disclosure.
- Security press (Cyber Security News) reports the 429-bug update and urges immediate patching; detailed bug-tracker entries remain embargoed.
Sources cited for Google Chrome 149.0.7827.53
- Chrome Patches 429 Vulnerabilities Including 22 Critical Ones – Update Now!
- NVD - CVE-2026-10881 (OOB read/write in ANGLE)
- NVD - CVE-2026-10883 (Type confusion in ANGLE)
- NVD - CVE-2026-10898 (Stack buffer overflow in GPU)
- Chrome Releases - Stable Channel Update for Desktop
- ANGLE Project (Chromium graphics translation layer)
Detection coverage for TL-2026-0720
As of 2026-06-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0720 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.