CVE-2026-87576: Google Chrome GPU Information Disclosure

CVE-2026-87576 Overview

CVE-2026-87576 is an uninitialized resource vulnerability in the Graphics Processing Unit (GPU) component of Google Chrome on Android. The flaw affects versions prior to 153.0.8010.36 and is tracked under [CWE-908: Use of Uninitialized Resource]. An attacker who has already compromised the renderer process can read memory outside the browser sandbox by delivering a crafted HTML page. Google's Chromium team classified the issue as Medium severity, while the National Vulnerability Database (NVD) assigned it a lower score reflecting the high attack complexity and limited confidentiality impact.

Critical Impact
Attackers with a compromised renderer can read memory outside the GPU process sandbox, potentially exposing sensitive data used in a broader Chrome sandbox escape chain.

Affected Products

Google Chrome for Android prior to version 153.0.8010.36
Google Android platforms running vulnerable Chrome builds
Chromium-based Android browsers sharing the affected GPU code path

Discovery Timeline

2026-09-09 - CVE-2026-87576 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87576

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process on Android. The GPU process handles rasterization, WebGL, and hardware-accelerated compositing for content produced by renderer processes. A resource inside this component is allocated without being fully initialized before use. When the renderer sends a crafted sequence of GPU commands from an attacker-controlled HTML page, the uninitialized resource returns memory contents that were never intended to be exposed. The result is a cross-process information disclosure that crosses the renderer-to-GPU trust boundary.

Root Cause

The root cause is a missing initialization step for a GPU-side resource, categorized as [CWE-908]. The code path assumes that a buffer, texture, or state object contains defined values at the time of first read. Because the allocation path does not zero or explicitly populate the memory, residual data from prior allocations remains accessible. An attacker who reaches this code path can observe that residual data through legitimate GPU readback operations.

Attack Vector

Exploitation requires a two-stage attack. First, the attacker must already control the renderer process, typically through a separate renderer bug. Second, the attacker uses that foothold to issue crafted GPU commands from a malicious HTML page. User interaction is required to visit the page, and the attack complexity is high because the initial renderer compromise is a prerequisite. Successful exploitation reads memory outside the renderer sandbox, which is valuable as a stepping stone toward a full sandbox escape.

No public proof-of-concept exploit is available. Technical specifics are tracked in the restricted Chromium Issue #506385755.

Detection Methods for CVE-2026-87576

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.36 that have loaded untrusted web content
Anomalous GPU process crashes or memory-access exceptions in Chrome telemetry following visits to unknown domains
Evidence of renderer process compromise preceding GPU-process anomalies, indicating chained exploitation

Detection Strategies

Inventory installed Chrome versions on managed Android endpoints and flag any build below 153.0.8010.36
Correlate browser telemetry with mobile threat defense logs to surface renderer crashes tied to specific URLs
Monitor mobile device management (MDM) compliance reports for delayed Chrome updates on corporate-enrolled Android devices

Monitoring Recommendations

Ingest Chrome update status from MDM platforms into the security data lake for continuous version compliance tracking
Alert on Android devices browsing high-risk or newly registered domains while running outdated Chrome builds
Review web proxy logs for repeated visits to pages serving heavy WebGL or GPU-intensive content from untrusted origins

How to Mitigate CVE-2026-87576

Immediate Actions Required

Update Google Chrome for Android to version 153.0.8010.36 or later through the Google Play Store
Enforce automatic Chrome updates on managed Android fleets using MDM policy
Prioritize patching for devices used by high-value users who browse untrusted content or handle sensitive data

Patch Information

Google released the fix in the Chrome Stable channel update documented at the Google Chrome Stable Update announcement. Users should confirm their Chrome version is 153.0.8010.36 or newer. Chromium-based browsers on Android that share the affected GPU code should apply the corresponding upstream fix once available.

Workarounds

Restrict browsing to trusted domains until Chrome is updated on affected Android devices
Deploy mobile threat defense agents that block navigation to known malicious sites hosting renderer exploits
Use enterprise browsing policies to disable or limit hardware acceleration where operationally acceptable as a temporary measure

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Force Chrome update through Google Play on managed devices
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.android.chrome"