CVE-2026-87643 Overview
CVE-2026-87643 is an integer overflow vulnerability in the GPU component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. The vulnerability is classified under CWE-190: Integer Overflow or Wraparound.
Critical Impact
Remote attackers can escape the Chrome sandbox and execute arbitrary code on Android devices by luring users to a malicious web page.
Affected Products
- Google Chrome for Android prior to 153.0.8010.36
- Google Android devices running vulnerable Chrome builds
- Chromium-based components sharing the affected GPU code path
Discovery Timeline
- 2026-09-09 - CVE-2026-87643 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87643
Vulnerability Analysis
The flaw resides in Chrome's GPU process on Android. An integer overflow occurs when the GPU component processes attacker-controlled values, causing a numeric wrap that leads to undersized memory allocations or incorrect boundary calculations. Subsequent operations write or read beyond intended limits, corrupting adjacent memory.
Because the defect lives in the GPU process, exploitation can break out of the renderer sandbox. Attackers gain code execution with the privileges of the GPU process, which is a well-known sandbox-escape target on Android.
Exploitation requires only that a user visit a crafted HTML page. No authentication is needed, and the attack scope crosses trust boundaries. Chromium rates the underlying security severity as Medium, but the NVD scoring reflects the sandbox-escape impact.
Root Cause
The root cause is an unchecked arithmetic operation on attacker-influenced input within GPU code paths. Under [CWE-190], integer overflow produces a smaller value than intended. This corrupted value then flows into allocation or indexing logic, resulting in memory corruption.
Attack Vector
An attacker hosts a malicious page that invokes GPU-accelerated features such as WebGL, WebGPU, or canvas rendering. When the victim's browser processes the crafted content, the overflow triggers memory corruption in the GPU process. Chained with additional primitives, this yields code execution outside the sandbox.
No verified public exploit code is available for CVE-2026-87643. Technical specifics are tracked in Chromium Issue Tracker #513416699.
Detection Methods for CVE-2026-87643
Indicators of Compromise
- Unexpected Chrome GPU process crashes on Android devices, particularly with signals such as SIGSEGV in GPU-related stack frames
- Outbound connections from mobile devices to unknown domains immediately after browsing sessions involving heavy WebGL or WebGPU content
- Installed Chrome versions on Android below 153.0.8010.36
Detection Strategies
- Inventory Chrome for Android versions across managed mobile devices and flag builds prior to 153.0.8010.36
- Monitor mobile threat defense telemetry for anomalous child process behavior spawned from Chrome
- Review web proxy and DNS logs for user visits to newly registered or low-reputation domains serving GPU-heavy content
Monitoring Recommendations
- Enable crash reporting for Chrome on Android and correlate GPU process crashes against known-bad URL indicators
- Track patch compliance through mobile device management (MDM) reports for Chrome updates
- Alert on installation of sideloaded Chromium-based browsers that may lag official patch cadence
How to Mitigate CVE-2026-87643
Immediate Actions Required
- Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store
- Push forced-update policies via enterprise MDM to accelerate rollout across managed devices
- Advise users to avoid untrusted links until patch compliance is verified
Patch Information
Google addressed the vulnerability in Chrome 153.0.8010.36. Refer to the Google Chrome Stable Update announcement for release details. Additional technical context is available in the Chromium Issue Tracker #513416699.
Workarounds
- Restrict browsing on affected devices to trusted, allowlisted domains until patches are applied
- Disable hardware acceleration in Chrome settings where feasible to reduce reachability of GPU code paths
- Use MDM policies to block installation of vulnerable Chrome versions and enforce automatic updates
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
