CVE-2026-87592: Google Chrome Tint Out of Bounds Read Flaw

CVE-2026-87592 Overview

CVE-2026-87592 is an out-of-bounds read vulnerability [CWE-125] in the Tint component of Google Chrome. Tint is the WebGPU Shading Language (WGSL) compiler used within Chrome's graphics stack. A remote attacker can craft a malicious HTML page that triggers the flaw to read memory inside the renderer sandbox. Google fixed the issue in Chrome 153.0.8010.36 and rated the underlying Chromium security severity as Low.

Exploitation requires user interaction, specifically visiting an attacker-controlled page. The impact is limited to confidentiality of memory within the sandboxed process, with no direct integrity or availability effect.

Critical Impact
A remote attacker can read arbitrary bytes from sandboxed renderer memory by luring a user to a crafted HTML page, potentially exposing sensitive process data.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Tint WGSL compiler
Desktop stable channel builds across supported platforms

Discovery Timeline

2026-09-09 - CVE-2026-87592 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87592

Vulnerability Analysis

The flaw resides in Tint, the WGSL shader compiler in Chrome's WebGPU implementation. Tint parses shader code supplied by web pages and lowers it to backend graphics representations. An out-of-bounds read occurs when Tint processes a specifically crafted shader or WebGPU input, causing the compiler to access memory outside the intended buffer bounds.

The returned data can include unrelated heap contents from the renderer process. Attackers can chain such reads with other primitives to leak pointers, defeat address space layout randomization (ASLR), or exfiltrate residual data held in the sandboxed process.

Root Cause

The root cause is missing or incorrect bounds validation in a Tint parsing or lowering routine. When index or offset values derived from attacker-controlled shader input exceed the allocated buffer size, the compiler reads past the buffer boundary. This is a classic [CWE-125] pattern in native C++ graphics code paths.

Attack Vector

Exploitation is remote and requires the victim to load a crafted HTML page that requests WebGPU and submits a malicious shader. No authentication is needed. The read is confined to the renderer sandbox, so achieving broader impact requires chaining with a sandbox escape or additional memory corruption. See the Chromium Issue Tracker Entry for upstream context.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87592

Indicators of Compromise

Chrome or Chromium browser processes running versions earlier than 153.0.8010.36 after the patch release date
Renderer process crashes or unusual WebGPU-related error entries in browser diagnostic logs
Outbound requests to unfamiliar domains that serve pages invoking WebGPU shader compilation

Detection Strategies

Inventory installed browser versions across managed endpoints and flag hosts below 153.0.8010.36
Monitor endpoint telemetry for renderer child processes exhibiting abnormal memory access patterns or repeated crashes tied to chrome.dll or the GPU process
Correlate web proxy logs with visits to unknown sites that trigger WebGPU features to identify potential targeting

Monitoring Recommendations

Ingest browser version data from configuration management or EDR into a centralized data lake for continuous compliance reporting
Alert on browser processes launched with WebGPU flags on hosts still running vulnerable builds
Track Chrome stable channel advisories via the Chrome Releases blog to catch related follow-up fixes

How to Mitigate CVE-2026-87592

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all endpoints
Restart the browser after the update installs to ensure the patched binaries are loaded
Confirm managed Chromium-based browsers pull the corresponding upstream fix from their vendors

Patch Information

Google addressed the issue in Chrome stable channel version 153.0.8010.36. See the Chrome Releases - Stable Update advisory for the full patch bulletin and the Chromium Issue Tracker Entry for technical detail.

Workarounds

Disable WebGPU via enterprise policy on endpoints that cannot receive the update immediately
Restrict browsing to trusted sites using web filtering or allowlisting until patches are deployed
Enable automatic Chrome updates through Group Policy or the Chrome Browser Cloud Management console

bash

# Configuration example: disable WebGPU via Chrome enterprise policy (Windows)
reg add "HKLM\Software\Policies\Google\Chrome" /v WebGpuEnabled /t REG_DWORD /d 0 /f

# Verify installed Chrome version meets the patched baseline
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version