CVE-2026-87586 Overview
CVE-2026-87586 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 153.0.8010.36. A remote attacker can serve a crafted HTML page that triggers the out-of-bounds read, allowing memory disclosure from outside the browser sandbox. Google classifies the Chromium security severity as Medium, and the vulnerability is tracked under CWE-125. Exploitation requires user interaction, such as visiting an attacker-controlled page.
Critical Impact
A remote attacker can read memory outside the ANGLE sandbox boundary through a crafted HTML page, potentially exposing sensitive process memory to the renderer.
Affected Products
- Google Chrome versions prior to 153.0.8010.36
- Chromium-based browsers embedding vulnerable ANGLE builds
- Desktop platforms served by the Chrome Stable channel
Discovery Timeline
- 2026-09-09 - CVE-2026-87586 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87586
Vulnerability Analysis
The vulnerability resides in ANGLE, the component Chrome uses to translate WebGL and OpenGL ES calls into the underlying platform graphics APIs such as Direct3D, Metal, or Vulkan. An out-of-bounds read occurs when ANGLE reads beyond the allocated bounds of a memory buffer while processing attacker-controlled graphics input. Because ANGLE operates in the GPU process context, leaked bytes can contain graphics buffers, shader data, or adjacent heap metadata. The attacker delivers the trigger through a crafted HTML page that issues specific WebGL or Canvas calls. The disclosed data can support secondary attacks by revealing addresses or state useful for defeating memory protections.
Root Cause
The root cause is missing or incorrect bounds validation on a buffer access path in ANGLE, consistent with CWE-125 (Out-of-bounds Read). Insufficient index or length checks allow the code to reference memory that extends past the intended buffer, returning data that was never meant to be exposed to web content.
Attack Vector
Exploitation is network-based and requires the victim to load a malicious page in an unpatched Chrome build. The attacker embeds JavaScript that drives ANGLE through WebGL, WebGPU, or Canvas APIs with parameters shaped to trigger the boundary condition. No authentication is required, and no local access is needed. Confidentiality impact is limited to memory outside the ANGLE sandbox as described in the advisory, without direct integrity or availability effects.
The vulnerability manifests in ANGLE's buffer access path exposed through WebGL. Google has not published proof-of-concept code. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update advisory for technical details as they are released.
Detection Methods for CVE-2026-87586
Indicators of Compromise
- Chrome processes running versions earlier than 153.0.8010.36 on managed endpoints.
- Renderer or GPU process crashes correlated with visits to unfamiliar domains hosting WebGL-heavy content.
- Outbound connections from browsers to newly registered domains delivering pages that heavily invoke WebGL or WebGPU shaders.
Detection Strategies
- Inventory Chrome installations across the fleet and flag any build below 153.0.8010.36 as vulnerable.
- Inspect browser telemetry for GPU process termination events accompanied by ANGLE-related stack frames.
- Use web proxy or DNS logs to identify users retrieving suspicious HTML pages that fingerprint WebGL capabilities before delivering shader payloads.
Monitoring Recommendations
- Track Chrome version compliance through endpoint management and alert on stalled update channels.
- Monitor for repeated GPU process crashes on a single endpoint, which can indicate probing of the ANGLE boundary condition.
- Correlate browser crash telemetry with web gateway logs to trace the originating URL.
How to Mitigate CVE-2026-87586
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all supported platforms.
- Restart browser instances after the update so the patched ANGLE binary is loaded.
- Verify Chromium-based third-party browsers have shipped an equivalent ANGLE update before considering endpoints remediated.
Patch Information
Google released the fix in the Chrome Stable channel as documented in the Google Chrome Stable Update advisory. Chromium tracks the underlying issue in the Chromium Issue Tracker Entry. Enterprises using managed Chrome deployments should force a policy-driven update to 153.0.8010.36 or later.
Workarounds
- Enforce automatic Chrome updates through enterprise policy so the patched build reaches endpoints without user action.
- Restrict access to untrusted sites via web filtering while patches propagate across the fleet.
- Disable hardware-accelerated WebGL on high-risk endpoints as a temporary measure until the update completes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
