CVE-2026-87596: Google Chrome ANGLE Information Disclosure

CVE-2026-87596 Overview

CVE-2026-87596 is an out-of-bounds read vulnerability [CWE-125] in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the issue by serving a crafted HTML page, causing the browser to read memory outside the sandbox boundary. Chromium security triage assigned the issue a High internal severity, while the NVD CVSS score reflects a lower confidentiality-only impact. Exploitation requires user interaction, specifically visiting an attacker-controlled page.

Critical Impact
A remote attacker can read process memory outside sandbox constraints through a crafted web page, potentially exposing sensitive data rendered or held in the browser process.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers using the vulnerable ANGLE component
Any downstream distribution shipping the pre-patch ANGLE build

Discovery Timeline

2026-09-09 - CVE-2026-87596 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87596

Vulnerability Analysis

The vulnerability resides in ANGLE (Almost Native Graphics Layer Engine), the component that translates WebGL and OpenGL ES calls into the underlying platform graphics API such as Direct3D, Metal, or Vulkan. An out-of-bounds read occurs when ANGLE processes attacker-controlled graphics state or shader input from a crafted HTML page. The read reaches memory outside the intended buffer, and the advisory states this occurs outside the sandbox boundary. The attacker gains the ability to leak in-process data that should remain isolated. Exploitation is remote and requires the victim to load a malicious page in the browser.

Root Cause

The root cause is missing or insufficient bounds validation on an index, offset, or length used during ANGLE processing of graphics API input. When the calculated read location exceeds the allocated buffer, the process returns adjacent memory contents rather than terminating the operation. This class of defect [CWE-125] commonly arises in complex parsers and translation layers where trusted invariants are not re-verified against untrusted input.

Attack Vector

The attack is delivered over the network through a crafted HTML page containing malicious WebGL or graphics-related content. The victim must visit the page or render the content in an embedded context such as an iframe or advertising slot. No privileges are required beyond a normal browser session. Successful exploitation results in disclosure of memory contents that may include tokens, cross-origin data, or pointers useful for chaining with additional flaws.

No public proof-of-concept or exploit code is available in Exploit-DB or referenced advisories at the time of publication. See the Chromium Issue Tracker #536434693 for technical details once access is opened.

Detection Methods for CVE-2026-87596

Indicators of Compromise

Chrome process crashes or renderer tab crashes correlated with visits to unfamiliar pages containing WebGL content
Outbound connections from browser processes to newly registered or low-reputation domains following page loads that trigger GPU activity
Presence of Chrome installations reporting a version string earlier than 153.0.8010.36

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36 as vulnerable
Monitor endpoint telemetry for unexpected renderer or GPU process anomalies tied to browser sessions
Correlate proxy logs with browser telemetry to identify visits to pages hosting anomalous WebGL payloads

Monitoring Recommendations

Enable browser version reporting through enterprise management tooling such as Chrome Browser Enterprise Core
Ingest browser and endpoint process telemetry into a centralized analytics platform for cross-source correlation
Track upstream Chromium security releases and align patch windows to the Chrome stable channel cadence

How to Mitigate CVE-2026-87596

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart browser processes after update to ensure the patched ANGLE binary is loaded
Verify enterprise policy enforces automatic Chrome updates and remove any pinning to older builds

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Google Chrome Desktop Update advisory. The fix ships in Chrome 153.0.8010.36 and later. Chromium-based browsers should pull the corresponding ANGLE fix in their next security update.

Workarounds

Disable hardware acceleration in Chrome settings to reduce ANGLE code path exposure where patching is delayed
Restrict WebGL through enterprise policy by setting DefaultWebGLSetting to blocked for high-risk user groups
Limit browsing to trusted sites via URL allowlisting until all endpoints reach the patched version

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy example (Linux JSON): disable WebGL as a temporary control
# /etc/opt/chrome/policies/managed/webgl_policy.json
{
  "DefaultWebGLSetting": 2
}