CVE-2026-87647: Google Chrome GPU Information Disclosure

CVE-2026-87647 Overview

CVE-2026-87647 is an uninitialized resource vulnerability [CWE-908] in the GPU component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox. Exploitation requires a crafted HTML page and user interaction. Chromium's security team rated the underlying issue High, though the assigned CVSS score reflects the required attacker preconditions and limited confidentiality impact.

Critical Impact
An attacker with a compromised renderer can read out-of-sandbox memory through the GPU process, potentially exposing sensitive data and aiding further sandbox escape chains.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the same GPU code path
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE CVE-2026-87647 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87647

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process, which handles graphics rendering across process boundaries. An uninitialized resource is created or referenced without being fully populated with defined data before it is used or transferred across the sandbox boundary. When a compromised renderer requests GPU operations, the uninitialized memory contents can be returned to the attacker-controlled process. This bypasses the memory isolation intended by Chrome's multi-process sandbox model. Exploitation depends on the attacker having already achieved code execution in the renderer, typically via a prior chained vulnerability.

Root Cause

The defect maps to [CWE-908: Use of Uninitialized Resource]. GPU buffer or texture memory is allocated and made accessible before the code path guarantees the underlying bytes are initialized. Residual data from prior GPU operations, or from adjacent memory regions, remains readable through legitimate GPU IPC calls.

Attack Vector

Exploitation is remote and requires user interaction, such as visiting a crafted HTML page. The attacker must first compromise the renderer process, then issue GPU commands designed to trigger the uninitialized read. The scope is changed because data crosses the renderer-GPU sandbox boundary. See the Chromium Issue #536673946 for tracking details.

No public proof-of-concept exploit is available. See the Google Chrome Stable Update advisory for the vendor description.

Detection Methods for CVE-2026-87647

Indicators of Compromise

Chrome browser versions earlier than 153.0.8010.36 present in endpoint inventory
Unexpected renderer process crashes or GPU process anomalies preceding data exfiltration
Outbound HTTPS traffic from browser processes to unrecognized domains following visits to untrusted pages

Detection Strategies

Inventory Chrome installations and flag hosts running versions below the fixed release
Correlate browser process telemetry with anomalous child-process behavior in the GPU or renderer
Monitor for exploit chains that combine renderer compromise with subsequent sandbox-adjacent memory access

Monitoring Recommendations

Enable browser update telemetry and alert on stalled update channels
Ingest endpoint process and network telemetry into a centralized data lake for cross-host correlation
Track visits to newly registered or low-reputation domains hosting complex HTML/JavaScript payloads

How to Mitigate CVE-2026-87647

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart browser sessions after patch deployment to ensure the vulnerable GPU process is replaced
Verify enterprise policy enforces automatic Chrome updates on the Stable channel

Patch Information

Google addressed this issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm deployment of version 153.0.8010.36 or higher across Windows, macOS, and Linux endpoints.

Workarounds

Restrict browsing to trusted sites via enterprise URL allowlists until patching completes
Disable GPU acceleration through the --disable-gpu command-line switch where operationally acceptable
Enforce site isolation and strict sandboxing policies via Chrome Enterprise configuration

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update check via enterprise policy (Windows example)
reg query "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault