CVE-2026-87500: Google Chrome ANGLE RCE Vulnerability

CVE-2026-87500 Overview

CVE-2026-87500 is an improper array index validation vulnerability in ANGLE, the graphics abstraction layer that translates OpenGL ES calls to native graphics APIs in Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and can be triggered when a user visits a crafted HTML page. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox. Google classifies the Chromium security severity as High, and the CVE carries a CVSS 3.1 score of 9.6. The vulnerability is tracked under CWE-129: Improper Validation of Array Index.

Critical Impact
Sandbox escape leading to arbitrary code execution on the host through a single crafted web page visit.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers using the vulnerable ANGLE component
Applications embedding affected Chromium builds

Discovery Timeline

2026-09-09 - CVE-2026-87500 published to NVD
2026-09-10 - Last updated in NVD database
2026-09 - Google releases Stable Channel update for Desktop addressing the issue (Chrome Releases)

Technical Details for CVE-2026-87500

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and OpenGL ES calls into Direct3D, Metal, or Vulkan operations on the host system. ANGLE runs in the GPU process, which historically has weaker sandboxing than renderer processes because it requires access to graphics drivers. An improper array index validation flaw in this component allows attacker-controlled input to reference memory outside intended buffer boundaries. Because ANGLE code paths execute in the GPU process, memory corruption here can bypass the renderer sandbox that normally contains web-originated code.

Root Cause

The issue is categorized as CWE-129: Improper Validation of Array Index. ANGLE accepts an index value derived from untrusted content without adequately verifying that the index falls within valid bounds. When the unchecked index is used to access an array, the process reads or writes memory outside the intended region. Attackers can shape the index and surrounding data to achieve controlled memory corruption. Further technical detail is tracked in Chromium Issue #540019091, which remains access-restricted at the time of publication.

Attack Vector

Exploitation requires a victim to load a crafted HTML page containing WebGL or graphics content that reaches the vulnerable ANGLE code path. No authentication or elevated privileges are required. The attacker delivers the payload through a malicious site, a compromised legitimate site, or a malicious advertisement in an ad network. After triggering memory corruption in the GPU process, an attacker can chain the primitive toward arbitrary code execution outside the sandbox, gaining code execution in the user context on the host operating system. The vulnerability manifests through standard web content, so no non-default browser configuration is needed.

Detection Methods for CVE-2026-87500

Indicators of Compromise

Unexpected crashes or restarts of the Chrome GPU process (chrome.exe --type=gpu-process) correlated with browsing activity
Chrome child processes spawning shells, script interpreters, or LOLBins such as powershell.exe, cmd.exe, or rundll32.exe
Outbound connections from browser processes to newly registered or low-reputation domains hosting graphics-heavy payloads
Creation of persistence artifacts (Run keys, scheduled tasks, LaunchAgents) shortly after browser sessions

Detection Strategies

Deploy endpoint behavioral rules that flag anomalous child process creation from chrome.exe and Chromium-based browsers
Correlate GPU process crash telemetry with subsequent process, file, and network events on the same host
Inspect proxy and DNS logs for WebGL-heavy URLs delivered from uncategorized or newly seen infrastructure
Maintain a browser software inventory to identify endpoints running Chrome versions below 153.0.8010.36

Monitoring Recommendations

Ingest browser process telemetry and Windows Event Logs into a central data lake for cross-source correlation
Alert on parent-child process anomalies where a browser process spawns unsigned or unexpected binaries
Track Chrome version distribution across the fleet and alert when out-of-date installations reappear
Review egress traffic from workstations to identify command-and-control patterns following browser exploitation

How to Mitigate CVE-2026-87500

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update installs so the patched binaries are loaded into memory
Push the update through enterprise management tooling to eliminate reliance on user-initiated updates
Audit Chromium-based browsers and embedded frameworks for downstream releases that incorporate the ANGLE fix

Patch Information

Google addressed the vulnerability in the Stable Channel update for Desktop, delivering Chrome 153.0.8010.36 and later builds. Details are published in the Google Chrome Stable Update announcement. Enterprises using Chrome Browser Cloud Management or group policy should verify auto-update settings and confirm rollout status across managed endpoints.

Workarounds

Restrict access to untrusted websites through DNS filtering, secure web gateways, or browser isolation until patching completes
Disable hardware acceleration (chrome://settings → System → Use graphics acceleration when available) to reduce exposure of the ANGLE code path
Apply the HardwareAccelerationModeEnabled enterprise policy to disable GPU acceleration temporarily on unpatched hosts
Block execution of unpatched Chrome versions using application allowlisting where feasible

bash

# Example: disable Chrome hardware acceleration via enterprise policy on Linux
sudo tee /etc/opt/chrome/policies/managed/disable_gpu.json > /dev/null <<'EOF'
{
  "HardwareAccelerationModeEnabled": false
}
EOF

# Verify current Chrome version on the endpoint
google-chrome --version