# Google Chrome 149.0.7827.53 — 429 Vulnerabilities Patched (22 Critical); Critical ANGLE/GPU Memory-Safety Sandbox-Escape Chain (CVE-2026-10881 / CVE-2026-10883 / CVE-2026-10898)

> Google shipped Chrome stable 149.0.7827.53 (Windows, macOS, Linux, iOS) fixing 429 vulnerabilities, 22 rated critical. The standout criticals are renderer-reachable memory-safety defects in ANGLE and the GPU process — an out-of-bounds read/write (CVE-2026-10881, CVSS 9.6) and type confusion (CVE-2026-10883) in ANGLE, and a GPU stack buffer overflow (CVE-2026-10898) — that chain crafted-HTML renderer compromise into GPU-process sandbox escape.

- **Published:** 2026-06-08T00:00:00Z
- **Last reviewed:** 2026-06-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0720
- **ID:** TL-2026-0720
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-10881, CVE-2026-10883, CVE-2026-10898

## Description

On 2026-06-04 Google promoted Chrome 149.0.7827.53 to the stable channel across Windows, macOS, Linux and Chrome for iOS, resolving 429 distinct security defects, 22 of which carry Chromium 'Critical' severity. The release is dominated by memory-safety bugs in the graphics and GPU paths, all reachable from untrusted web content rendered in a tab.

CVE-2026-10881 is an out-of-bounds read and write in ANGLE (Almost Native Graphics Layer Engine), Chrome's OpenGL ES translation layer that backs WebGL and WebGPU. A crafted HTML page driving malformed graphics state triggers OOB access within the GPU process, which ANGLE runs inside. NVD scores it CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) with a CHANGED scope, reflecting that successful exploitation crosses the renderer/GPU sandbox boundary toward a sandbox escape (CWE-125, CWE-787).

CVE-2026-10883 is a type confusion in ANGLE leading to heap corruption (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Conflating one object type for another inside the GPU process gives an attacker controlled read/write primitives over the heap — a classic stepping stone toward arbitrary code execution in the GPU process.

CVE-2026-10898 is a stack buffer overflow in the GPU component (CVSS 8.3, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, CWE-121). NVD's description is explicit that it requires an attacker who has 'already compromised the renderer process' and then performs a sandbox escape via a crafted HTML page — i.e. it is the back half of a two-stage chain in which a renderer bug (such as a V8 or DOM use-after-free) is paired with a GPU-process memory-safety bug to break out of the sandbox.

Beyond the three headline ANGLE/GPU criticals, the patch set closes a broad sweep of use-after-free conditions across Network, Chromecast, Cast Streaming, Chromoting (Chrome Remote Desktop), Printing, FileSystem, GFX and Ozone, plus the iOS WebKit-adjacent layer; high-severity type confusion and implementation bugs in V8; use-after-free in WebRTC, WebAuthentication, Audio and UI; and integer overflows in Dawn (WebGPU backend), DevTools, and Media. Google is withholding detailed bug-tracker entries and restricting access to the bug details until a majority of users have updated, per its standard disclosure embargo.

At time of analysis there is no confirmed in-the-wild exploitation and no public proof-of-concept for the three tracked CVEs. However, ANGLE and GPU-process memory-safety bugs are a historically favored target for browser exploit chains because the GPU process is less hardened than the renderer and sits adjacent to the OS graphics stack. The combination of network attack vector, no privileges required, and only user interaction (visiting a page) makes these prime candidates for weaponization once details or patches are diffed.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1055 Process Injection
- T1587.004 Develop Capabilities: Exploits
- T1608.004 Stage Capabilities: Drive-by Target
- T1592.002 Gather Victim Host Information: Software
- T1105 Ingress Tool Transfer
- T1005 Data from Local System

## Sources

- [Chrome Patches 429 Vulnerabilities Including 22 Critical Ones – Update Now!](https://cybersecuritynews.com/chrome-patches-429-vulnerabilities/)
- [NVD - CVE-2026-10881 (OOB read/write in ANGLE)](https://nvd.nist.gov/vuln/detail/CVE-2026-10881)
- [NVD - CVE-2026-10883 (Type confusion in ANGLE)](https://nvd.nist.gov/vuln/detail/CVE-2026-10883)
- [NVD - CVE-2026-10898 (Stack buffer overflow in GPU)](https://nvd.nist.gov/vuln/detail/CVE-2026-10898)
- [Chrome Releases - Stable Channel Update for Desktop](https://chromereleases.googleblog.com/)
- [ANGLE Project (Chromium graphics translation layer)](https://chromium.googlesource.com/angle/angle)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0720