CVE-2026-87512 Overview
CVE-2026-87512 is a use-after-free vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the vulnerability by luring a user to a crafted HTML page, then execute arbitrary code outside the browser sandbox. Chromium classifies the security severity as High. The vulnerability is tracked under CWE-416 and requires user interaction with attacker-controlled web content.
Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox on Windows hosts, giving attackers a foothold on the underlying operating system through a single crafted webpage.
Affected Products
- Google Chrome for Windows prior to 153.0.8010.36
- Microsoft Windows hosts running vulnerable Chrome builds
- Chromium-derived browsers on Windows that share the affected ANGLE component
Discovery Timeline
- 2026-09-09 - CVE-2026-87512 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87512
Vulnerability Analysis
The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component Chrome uses to translate WebGL and other graphics API calls into Direct3D on Windows. A use-after-free condition occurs when ANGLE retains a reference to a graphics resource after that resource has been released. Subsequent access to the freed memory allows an attacker to influence object state, hijack control flow, and execute arbitrary code.
Because ANGLE runs with elevated privileges relative to sandboxed renderer processes on Windows, memory corruption inside this component allows an attacker to escape the renderer sandbox. Successful exploitation results in code execution in the context of the browser process. The attack requires only that a victim load a malicious HTML page in a vulnerable Chrome build.
Root Cause
The root cause is object lifetime mismanagement inside ANGLE. Code paths free a graphics resource while another reference remains valid, then later dereference the stale pointer. This class of defect is categorized as CWE-416: Use After Free and is a recurring source of sandbox escapes in browser graphics stacks.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that issues specific WebGL or graphics API sequences to trigger the use-after-free in ANGLE. Delivery channels include phishing links, malicious advertisements, watering-hole sites, and compromised third-party content embedded in trusted pages. No authentication is required. See the Chromium Issue Tracker entry for additional technical context.
No public proof-of-concept or exploit code has been published at the time of this writing.
Detection Methods for CVE-2026-87512
Indicators of Compromise
- Chrome renderer or GPU process crashes with access violation exceptions referencing libGLESv2.dll or ANGLE symbols
- Unexpected child processes spawned by chrome.exe following user navigation to untrusted sites
- Outbound connections from Chrome host processes to previously unseen domains hosting WebGL-heavy content
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 153.0.8010.36
- Alert on browser process anomalies such as code execution originating from GPU or renderer child processes
- Correlate Windows Error Reporting telemetry for Chrome faults with recent browsing history to identify targeted exploitation attempts
Monitoring Recommendations
- Ingest endpoint process telemetry and browser crash events into a centralized analytics platform for cross-host correlation
- Monitor for post-exploitation behaviors such as credential access, LSASS interaction, and lateral movement following browser compromise
- Track newly registered domains serving WebGL or heavy graphics payloads referenced in email or web proxy logs
How to Mitigate CVE-2026-87512
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
- Force-restart Chrome after deployment to ensure the patched binaries are loaded
- Audit enterprise browser fleets, including Chromium-derived browsers, for shared ANGLE components requiring vendor updates
Patch Information
Google addressed the vulnerability in the Chrome Stable channel update documented in the Chrome Releases advisory. Administrators should validate that managed installations receive 153.0.8010.36 or later through Google Update, enterprise MSI packages, or configuration management tooling.
Workarounds
- Disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths until patching completes
- Restrict WebGL through enterprise policy (WebGLEnabled=false) on high-risk user groups pending update deployment
- Enforce web filtering and block access to untrusted or newly registered domains that could host exploit pages
# Windows Group Policy registry example to disable WebGL and hardware acceleration
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v WebGLEnabled /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
