CVE-2026-87604: Google Chrome ANGLE RCE Vulnerability

CVE-2026-87604 Overview

CVE-2026-87604 is an out-of-bounds read vulnerability in ANGLE, the graphics abstraction layer used by Google Chrome to translate OpenGL ES calls to native graphics APIs. The flaw affects Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory outside the intended bounds. This condition can be chained to execute arbitrary code outside the browser sandbox. Google classifies the Chromium security severity as High, and the vulnerability is tracked under [CWE-125].

Critical Impact
Successful exploitation enables sandbox escape from a compromised renderer, giving attackers code execution in a higher-privileged browser process context.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers that embed the vulnerable ANGLE component
Applications using the affected ANGLE library versions

Discovery Timeline

2026-09-09 - CVE-2026-87604 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87604

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates WebGL and OpenGL ES calls into calls supported by the host platform's graphics API, such as Direct3D, Metal, or Vulkan. An out-of-bounds read [CWE-125] in this component allows attacker-controlled input to trigger memory access beyond the boundaries of a valid buffer. In Chrome's architecture, ANGLE runs in the GPU process, which sits at a higher privilege boundary than the renderer sandbox.

An attacker who has already achieved code execution in the renderer through a separate vulnerability can send crafted graphics commands to ANGLE. The out-of-bounds read leaks memory contents or corrupts state in the GPU process, providing the primitives needed to escape the renderer sandbox.

Root Cause

The root cause is missing or insufficient bounds validation on data processed by ANGLE when handling attacker-controlled graphics inputs. When the affected code path processes a crafted resource, it reads past the allocated buffer boundary, exposing adjacent memory or destabilizing the GPU process.

Attack Vector

Exploitation requires two stages. First, the attacker compromises the renderer process, typically through a separate memory corruption vulnerability triggered by visiting a malicious page. Second, the attacker sends crafted WebGL or graphics commands from the compromised renderer to ANGLE. User interaction is required, since the victim must load the attacker-controlled HTML page. The high attack complexity reflects the prerequisite of an existing renderer compromise. Full technical details are restricted; see the Chromium Issue Tracker #536648007.

Detection Methods for CVE-2026-87604

Indicators of Compromise

Unexpected Chrome GPU process crashes or restarts correlated with visits to untrusted web pages
Chrome renderer processes spawning child processes or writing to unusual filesystem locations
Anomalous WebGL or graphics API traffic patterns from browser tabs prior to a crash event
Chrome versions below 153.0.8010.36 observed in software inventory scans

Detection Strategies

Inventory endpoints for Chrome builds older than 153.0.8010.36 using endpoint management tooling
Monitor for browser process trees where chrome.exe renderer or GPU processes spawn unexpected children
Correlate GPU process crash telemetry with subsequent process creation or persistence events
Ingest browser telemetry into a security data lake and alert on sandbox escape behavioral patterns

Monitoring Recommendations

Enable browser crash reporting and forward Chrome GPU process crash dumps to central analysis
Track outbound network connections initiated by non-standard child processes of Chrome
Monitor filesystem and registry writes originating from Chrome subprocess trees
Alert on Chrome version drift where endpoints remain on unpatched builds beyond a defined window

How to Mitigate CVE-2026-87604

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into active processes
Audit any Chromium-based browsers and Electron applications for embedded ANGLE versions and update accordingly
Verify auto-update policies are enforced and not blocked by proxy or network configurations

Patch Information

Google released the fix in the Chrome Stable Channel update to 153.0.8010.36. Refer to the Google Chrome Stable Update advisory for the full list of fixed issues. Enterprise administrators should deploy the update through Chrome Enterprise policies or their standard patch management workflow.

Workarounds

Restrict access to untrusted websites through web filtering and DNS security controls until patches are deployed
Disable WebGL through the --disable-webgl flag or enterprise policy where business use cases permit
Apply site isolation policies to reduce the impact of a renderer compromise
Deploy application allowlisting to block unauthorized child processes spawned from Chrome

bash

# Verify Chrome version on Windows
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --version

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version

# Enterprise policy example (Windows registry) to disable WebGL
reg add "HKLM\Software\Policies\Google\Chrome" /v "WebGLEnabled" /t REG_DWORD /d 0 /f