CVE-2026-87602: Google Chrome ANGLE Information Disclosure

CVE-2026-87602 Overview

CVE-2026-87602 is an out-of-bounds read vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36 and can be triggered by a crafted HTML page. A remote attacker who convinces a user to visit a malicious page can read memory outside the browser sandbox boundary. Google Chromium classifies the internal severity as Low, while the assigned CVSS score reflects a medium-severity information disclosure issue. The weakness is tracked as [CWE-125: Out-of-bounds Read].

Critical Impact
Remote attackers can read process memory outside the sandbox, potentially exposing sensitive browser state or leaked pointers useful for chaining with other vulnerabilities.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
ANGLE graphics translation layer bundled with Chromium
Downstream Chromium-based browsers on Windows that ship the vulnerable ANGLE build

Discovery Timeline

2026-09-09 - CVE-2026-87602 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87602

Vulnerability Analysis

The vulnerability resides in ANGLE, the graphics abstraction layer that translates OpenGL ES API calls to native Direct3D calls on Windows. An out-of-bounds read occurs when ANGLE processes attacker-controlled graphics state derived from WebGL or related content in a crafted HTML page.

Because ANGLE runs within the GPU process, memory read beyond intended buffer boundaries may expose adjacent process memory. This memory can include graphics resources, cached content, or pointers that undermine address space layout randomization (ASLR). The advisory describes the impact as reading memory outside the sandbox, which is significant because sandbox escape is typically a prerequisite for full compromise.

No public proof-of-concept is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or incorrect bounds validation on a buffer accessed during ANGLE's rendering pipeline. When the untrusted HTML page supplies parameters that influence buffer indices or sizes, ANGLE reads past the allocated region. This condition maps directly to [CWE-125] and is common in graphics translation layers that convert between API models with differing validation semantics.

Attack Vector

Exploitation requires the victim to load attacker-controlled web content in Chrome on Windows. The attacker hosts a crafted HTML page, likely using WebGL or another GPU-backed API, and delivers it via phishing, malvertising, or a compromised site. User interaction is limited to visiting the page. No authentication or elevated privileges are required. Successful exploitation discloses memory content back to attacker-controlled JavaScript or observable side effects, which the attacker can exfiltrate.

No verified public exploit code is available for CVE-2026-87602. Technical details are tracked in Chromium Issue #541546782.

Detection Methods for CVE-2026-87602

Indicators of Compromise

Chrome browser processes on Windows running versions earlier than 153.0.8010.36
GPU process crashes or unusual renderer telemetry correlated with visits to unfamiliar domains
Outbound requests to domains hosting WebGL-heavy pages immediately preceding anomalous browser behavior

Detection Strategies

Inventory installed Chrome builds across the Windows fleet and flag hosts below 153.0.8010.36 for remediation tracking.
Correlate web proxy logs with browser process telemetry to identify visits to newly registered or low-reputation domains serving WebGL content.
Monitor GPU process crash reports and renderer exit codes for repeated abnormal terminations that may indicate exploitation attempts.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized analytics platform to correlate Chrome version data with user browsing activity.
Alert on Chrome processes spawning unexpected child processes or performing anomalous file and network operations following exposure to untrusted content.
Track patch compliance metrics and generate alerts when hosts remain on vulnerable Chrome versions beyond a defined SLA.

How to Mitigate CVE-2026-87602

Immediate Actions Required

Update Google Chrome on Windows to version 153.0.8010.36 or later across all managed endpoints.
Restart Chrome after the update to ensure the patched ANGLE component is loaded into memory.
Verify Chromium-based browsers derived from the same upstream code have integrated the corresponding ANGLE fix.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update. Deploy Chrome 153.0.8010.36 or newer using enterprise management tools such as Group Policy, Microsoft Intune, or Chrome Browser Cloud Management. Additional technical context is available in Chromium Issue #541546782.

Workarounds

Restrict access to untrusted websites through DNS filtering or secure web gateway policies until patches are deployed.
Disable hardware acceleration in Chrome as a temporary measure to reduce reliance on ANGLE, understanding that this may degrade rendering performance.
Enforce strict site isolation and keep the browser sandbox enabled to limit the exploitability window for information disclosure.

bash

# Configuration example: enforce minimum Chrome version via Windows Group Policy registry keys
reg add "HKLM\Software\Policies\Google\Chrome" /v "HardwareAccelerationModeEnabled" /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v "SitePerProcess" /t REG_DWORD /d 1 /f