CVE-2026-11005 is an out of bounds read vulnerability in the ANGLE graphics abstraction layer within Google Chrome on Windows platforms. It affects versions prior to 149.0.7827.53. Exploitation requires that the attacker has already compromised the renderer process, after which they can leverage a crafted HTML page to read sensitive memory contents. The vulnerability does not allow code execution or denial of service but can lead to information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation can lead to disclosure of potentially sensitive information from the process memory of the Chrome renderer. This could aid attackers in further compromising the system or user data. There is no indication of code execution or denial of service impact. No known exploits in the wild have been reported at this time.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update affected Chrome installations to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides official update information. No additional mitigations are indicated by the vendor.