CVE-2026-87488: Google Chrome WebGL Use After Free Vulnerability

CVE-2026-87488 Overview

CVE-2026-87488 is a use-after-free vulnerability in the WebGL component of Google Chrome on Android. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires a target user to load a crafted HTML page. Google's Chromium security team rated the issue Critical, reflecting the potential for sandbox escape from a single web navigation on mobile devices. The vulnerability is tracked under CWE-416 (Use After Free).

Critical Impact
Arbitrary code execution outside the Chrome sandbox on Android devices through a single crafted web page.

Affected Products

Google Chrome for Android prior to 153.0.8010.36
Google Android platform hosting vulnerable Chrome builds
WebGL rendering component within Chromium

Discovery Timeline

2026-09-09 - CVE-2026-87488 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database
2026-09 - Google releases Chrome Stable Channel update containing the fix (Chrome Releases)

Technical Details for CVE-2026-87488

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, which exposes GPU rendering primitives to JavaScript running in web pages. A use-after-free condition occurs when WebGL code continues to reference a memory object after that object has been released. An attacker who controls the timing of object allocation and destruction can reclaim the freed memory with attacker-influenced data. Subsequent access by the renderer dereferences the corrupted pointer, giving the attacker control over program flow inside the GPU process. Chromium classified the severity as Critical because successful exploitation escapes the renderer sandbox and executes code in a higher-privileged context on Android.

Root Cause

The root cause is improper lifetime management of a WebGL object, mapped to CWE-416. Chrome frees the underlying resource while a reachable reference still exists. WebGL's asynchronous command scheduling and its interaction with the GPU process make these lifetime bugs particularly impactful on mobile GPUs. Detailed root-cause information is tracked in Chromium Issue #546252753.

Attack Vector

The attack vector is network-based and requires user interaction. A target visits a malicious or compromised web page that serves attacker-crafted HTML and JavaScript invoking specific WebGL APIs. The page triggers the use-after-free, sprays the reclaimed allocation, and pivots to arbitrary code execution outside the Chrome sandbox on the Android device. No credentials are required. The scope change reflected in the vector indicates that impact extends beyond the vulnerable component into the broader Android runtime.

No public proof-of-concept exploit is available at publication. Technical details are documented in Chromium Issue #546252753.

Detection Methods for CVE-2026-87488

Indicators of Compromise

Chrome renderer or GPU process crashes on Android correlated with WebGL page loads
Unexpected child processes spawned by Chrome shortly after navigation to an untrusted domain
Outbound connections from mobile devices to newly registered or low-reputation domains hosting HTML with heavy WebGL usage
Android application installations or configuration changes following a browser session

Detection Strategies

Inventory Chrome versions across managed Android endpoints and flag any build below 153.0.8010.36
Inspect web proxy and DNS telemetry for HTML pages that aggressively invoke WebGL APIs from untrusted origins
Correlate browser crash telemetry with subsequent process or persistence events on the same device
Hunt for anomalous GPU process behavior and unexpected native library loads inside the Chrome process tree

Monitoring Recommendations

Ingest mobile browser and Android device telemetry into a centralized data lake for cross-source correlation
Alert on Chrome versions that fall behind the vendor's Stable Channel release cadence
Monitor mobile device management (MDM) compliance reports for delayed Chrome updates
Track threat intelligence for exploit kits weaponizing WebGL sandbox escapes

How to Mitigate CVE-2026-87488

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later on all managed devices
Push the update through MDM or enterprise mobility management to enforce compliance
Restrict browsing to untrusted sites from unpatched Android devices until remediation completes
Validate that Chrome auto-update is enabled and functioning on Android endpoints

Patch Information

Google released the fix in the Chrome Stable Channel update documented on the Chrome Releases blog. Upgrading Chrome on Android to 153.0.8010.36 or later remediates the vulnerability. Administrators should confirm rollout through Google Play managed configurations or their MDM platform.

Workarounds

Where patching is delayed, direct users to an alternative browser that is not affected by this Chromium build
Use enterprise policy to restrict WebGL on managed browser profiles where feasible
Apply network-level filtering to block known malicious domains hosting exploit content
Enforce site isolation and up-to-date Android security patch levels to reduce post-exploitation impact

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 153.0.8010.36 or later