CVE-2026-87464: Google Chrome WebGL Use After Free Vulnerability

CVE-2026-87464 Overview

CVE-2026-87464 is a use-after-free vulnerability [CWE-416] in the WebGL component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation permits arbitrary code execution outside the Chrome renderer sandbox. Google's Chromium team assigned this issue a Critical security severity rating.

The vulnerability requires user interaction, specifically visiting an attacker-controlled or compromised web page. No authentication is required and the attack originates over the network.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox by luring a user to a crafted HTML page rendering WebGL content.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable ANGLE/WebGL code
Desktop channels (Windows, macOS, Linux) receiving the Stable Channel update

Discovery Timeline

2026-09-09 - CVE-2026-87464 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87464

Vulnerability Analysis

The vulnerability resides in WebGL, the JavaScript API used to render interactive 2D and 3D graphics in the browser. WebGL in Chrome is implemented on top of ANGLE, which translates OpenGL ES calls to the underlying graphics driver. A use-after-free occurs when code continues to reference a memory region after it has been released back to the allocator.

An attacker who controls the timing and layout of freed WebGL objects can reclaim that memory with attacker-influenced data. Subsequent dereferences of the stale pointer allow control over program flow. Because the flaw enables code execution outside the sandbox, exploitation bypasses one of Chrome's principal isolation boundaries. The Chromium code review referenced in the advisory targets the ANGLE component, indicating the fix lives in ANGLE's graphics translation layer.

Root Cause

The root cause is improper object lifetime management inside WebGL/ANGLE. An object referenced by the rendering pipeline is freed while another code path retains and later uses a pointer to that object. The condition is triggered through specific sequences of WebGL API calls issued from JavaScript in a crafted HTML page.

Attack Vector

Exploitation requires a victim to load an attacker-controlled HTML document in a vulnerable Chrome build. The page issues WebGL calls that trigger the use-after-free and then shape the heap to gain a controlled read/write primitive. Chained with sandbox escape logic, the attacker achieves arbitrary code execution at the privilege level of the browser process.

No verified public proof-of-concept is available at the time of publication. Additional technical detail is tracked in the Chromium Issue Tracker and the Chromium Code Review.

Detection Methods for CVE-2026-87464

Indicators of Compromise

Unexpected chrome.exe or Google Chrome Helper child processes spawning shells, scripting engines, or LOLBins after web browsing
Chrome renderer or GPU process crashes referencing libGLESv2, ANGLE, or WebGL contexts prior to a subsequent process launch
Outbound network connections from Chrome to newly registered or low-reputation domains hosting WebGL-heavy content

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
Correlate browser process crashes with subsequent process creation events to identify post-exploitation activity
Inspect proxy and DNS telemetry for users visiting untrusted sites that serve WebGL payloads

Monitoring Recommendations

Enable process lineage and command-line auditing on endpoints to capture anomalous children of the browser
Ingest browser telemetry and endpoint logs into a centralized data lake for cross-source correlation
Alert on Chrome update failures or version drift that leave endpoints on unpatched builds

How to Mitigate CVE-2026-87464

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched binaries and renderer processes are loaded
Validate Chromium-based browsers and embedded frameworks for downstream fixes incorporating the ANGLE patch

Patch Information

Google addressed the vulnerability in the Stable Channel update announced in the Google Chrome Stable Update. The corresponding ANGLE fix is tracked in the Chromium Code Review. Coordinated disclosure details are mirrored on the OpenWall OSS Security list.

Workarounds

Disable WebGL through enterprise policy where business use cases permit, using the WebGLEnabled policy set to false
Restrict browsing to trusted sites via web filtering while patches are rolled out
Enforce Chrome auto-update through group policy or mobile device management to minimize version drift

bash

# Example: Disable WebGL via Chrome enterprise policy on Linux
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/disable_webgl.json
{
  "WebGLEnabled": false
}
EOF

# Verify the current Chrome version meets the patched baseline
google-chrome --version