CVE-2026-87621 Overview
CVE-2026-87621 is an out-of-bounds write vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to potentially execute arbitrary code outside the browser sandbox through a crafted HTML page. Google classifies the Chromium security severity as High. The weakness is tracked under CWE-787 and requires user interaction, such as visiting a malicious website. Sandbox escape potential makes this issue particularly relevant to enterprise browsers and workstations used for general web browsing.
Critical Impact
A successful exploit enables arbitrary code execution outside the Chrome sandbox on Windows hosts, giving attackers a path to full endpoint compromise from a single crafted web page.
Affected Products
- Google Chrome for Windows prior to 153.0.8010.36
- Microsoft Windows systems running vulnerable Chrome builds
- Chromium-based components that embed the affected ANGLE version
Discovery Timeline
- 2026-09-09 - CVE-2026-87621 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87621
Vulnerability Analysis
ANGLE translates OpenGL ES API calls made by Chrome and its WebGL implementation into native Direct3D calls on Windows. An out-of-bounds write [CWE-787] in this translation layer means Chrome writes data beyond an allocated buffer boundary while processing graphics commands. Because ANGLE runs inside the GPU process, memory corruption here can be leveraged to escape the renderer sandbox and execute code in a more privileged context. Exploitation is triggered by loading a crafted HTML page that issues malicious WebGL or graphics operations. The scope change reflected in the CVSS metrics indicates that a successful exploit crosses the browser security boundary.
Root Cause
The root cause is improper bounds checking in ANGLE's handling of graphics input on Windows builds prior to 153.0.8010.36. When specific shader, texture, or buffer parameters are supplied, the affected code path writes past the end of an allocated region, corrupting adjacent memory in the GPU process.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a malicious HTML page that invokes the vulnerable ANGLE code path through WebGL or related graphics APIs. When a user visits the page in a vulnerable Chrome build, the out-of-bounds write can be used to corrupt process memory and pivot toward sandboxed code execution and eventual sandbox escape. No authentication is required.
// No verified public proof-of-concept is available for CVE-2026-87621.
// See the Chromium issue tracker entry #536664909 and the Google Chrome
// stable channel advisory for authoritative technical details.
Detection Methods for CVE-2026-87621
Indicators of Compromise
- Unexpected crashes or restarts of the Chrome GPU process (chrome.exe --type=gpu-process) shortly after web browsing activity
- Child processes spawned by Chrome that are inconsistent with normal browser behavior, especially command interpreters or scripting hosts
- Outbound network connections from Chrome-spawned processes to previously unseen or low-reputation domains
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build lower than 153.0.8010.36
- Monitor for GPU process crash telemetry combined with subsequent process creation or persistence activity on the same host
- Correlate browsing telemetry with endpoint process trees to identify HTML pages preceding anomalous Chrome child processes
Monitoring Recommendations
- Ingest Chrome crash reports and Windows Error Reporting events into a central data lake for trend analysis
- Alert on Chrome processes writing executables to disk or modifying autoruns
- Track Chrome update compliance as a continuous security metric rather than a one-time check
How to Mitigate CVE-2026-87621
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
- Verify managed browser deployments (MSI, Intune, SCCM, group policy) are pushing the patched build
- Restart Chrome after update to ensure the vulnerable GPU process is no longer running
Patch Information
Google released the fix in the Chrome stable channel update documented in the Google Chrome Desktop Update advisory. Technical fix details are referenced in Chromium Issue #536664909. Chrome versions 153.0.8010.36 and later on Windows contain the corrected ANGLE code path.
Workarounds
- Disable hardware-accelerated graphics in Chrome to reduce ANGLE attack surface until patching is complete
- Restrict access to untrusted websites through enterprise web filtering while updates are rolled out
- Enforce browser isolation for high-risk user groups such as executives and administrators
# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Force Chrome to check for updates (from an elevated prompt)
"C:\Program Files\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.