CVE-2026-87642: Google Chrome WebGL Information Disclosure

CVE-2026-87642 Overview

CVE-2026-87642 is an uninitialized resource vulnerability [CWE-908] in the WebGL component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Google classified the Chromium security severity as Medium.

The flaw enables cross-origin information disclosure through the browser's graphics rendering pipeline. Exploitation requires user interaction, such as loading a malicious page, but no privileges or authentication. Successful exploitation compromises confidentiality of data that should remain isolated by the same-origin policy.

Critical Impact
Remote attackers can read cross-origin data via a crafted HTML page, breaking web isolation guarantees enforced by the browser.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable WebGL code path
Desktop Chrome Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87642 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87642

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, which exposes GPU-accelerated 2D and 3D graphics to web content. WebGL allocates buffers, textures, and framebuffers that are shared between untrusted JavaScript and the underlying graphics stack. When one of these resources is used before being fully initialized, its contents may reflect residual memory left by prior operations.

An attacker-controlled page can read this residual data through standard WebGL APIs. Because GPU memory is shared across origins and processes, the leaked bytes can include pixels, textures, or buffers belonging to other web origins. This breaks the same-origin policy that browsers use to isolate sites from one another.

The issue is tracked as Chromium Issue 501644790 and was addressed in the Chrome Stable channel update announced in the Google Chrome Stable Update.

Root Cause

The root cause is an uninitialized resource condition classified as [CWE-908]. A WebGL object is allocated and made accessible to script before its backing memory is zeroed or overwritten with defined data. Reads against the object return stale bytes from previously used GPU or system memory regions.

Attack Vector

Exploitation follows a network attack vector and requires user interaction. The attacker hosts a crafted HTML page that instantiates specific WebGL objects and issues read operations against them. When a victim visits the page, the returned data can contain fragments of cross-origin content rendered by the browser. No authentication, elevated privileges, or local access are required.

Because no verified public exploit code is available, technical specifics are described in prose. See the Chromium Issue Tracker Update for implementation details as they become public.

Detection Methods for CVE-2026-87642

Indicators of Compromise

Browser telemetry showing Chrome versions below 153.0.8010.36 on managed endpoints after the patch release date
Outbound requests from browsers to newly registered domains hosting pages that heavily exercise WebGL APIs
Web proxy logs containing HTML responses that instantiate WebGL contexts followed by outbound POST requests carrying binary payloads

Detection Strategies

Inventory Chrome installations across the fleet and flag any build earlier than 153.0.8010.36 as vulnerable
Correlate browsing history and DNS logs with threat intelligence covering domains known to serve malicious WebGL content
Alert on unusual volumes of GPU-related crash reports or renderer process anomalies that could indicate exploitation attempts

Monitoring Recommendations

Enable centralized browser version reporting through enterprise management policies
Forward endpoint browser telemetry to a centralized data lake for version compliance and behavioral analytics
Monitor egress traffic from browser processes for exfiltration patterns following visits to untrusted sites

How to Mitigate CVE-2026-87642

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart browser sessions after the update to ensure the patched renderer process is active
Audit third-party Chromium-based browsers and apply vendor updates that incorporate the upstream Chromium fix

Patch Information

Google addressed the vulnerability in Chrome Stable 153.0.8010.36. Details are published in the Google Chrome Stable Update release notes. The corresponding Chromium fix is tracked at Chromium Issue 501644790.

Workarounds

Disable WebGL through enterprise policy where business workflows do not depend on it, using the HardwareAccelerationModeEnabled or WebGL policy controls
Restrict browsing to trusted sites via URL allow-listing until the patch is deployed
Deploy browser isolation or remote browser technologies for high-risk user groups

bash

# Enterprise policy example to disable WebGL via Chrome policy (Linux managed preferences)
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable_webgl.json
{
  "HardwareAccelerationModeEnabled": false,
  "URLBlocklist": ["javascript://*webgl*"]
}
EOF