CVE-2026-87648: Google Chrome ANGLE Use After Free Flaw

CVE-2026-87648 Overview

CVE-2026-87648 is a use-after-free vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to trigger the use-after-free and potentially execute arbitrary code outside the Chrome sandbox. Google's Chromium team rated the security severity as Medium, while NVD assigned a higher CVSS score reflecting the sandbox escape impact. The weakness is tracked under CWE-416: Use After Free.

Critical Impact
A successful exploit chained with a renderer compromise can break out of the Chrome sandbox and execute arbitrary code on the host, giving attackers direct access to the Windows user context.

Affected Products

Google Chrome for Windows prior to 153.0.8010.36
Microsoft Windows (all supported versions running vulnerable Chrome builds)
Chromium-based browsers reusing the affected ANGLE component

Discovery Timeline

2026-09-09 - CVE-2026-87648 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database
2026-09-10 - EPSS score published at 0.276% (percentile 19.9)

Technical Details for CVE-2026-87648

Vulnerability Analysis

The vulnerability resides in ANGLE, the translation layer that converts WebGL and other OpenGL ES calls into native Direct3D, Vulkan, or Metal commands. ANGLE runs inside the GPU process, which historically has broader access to graphics drivers and kernel interfaces than the renderer process. A use-after-free condition in ANGLE allows an attacker who controls a compromised renderer to reuse memory that has already been freed. When the freed object is dereferenced during subsequent graphics operations, the attacker can hijack control flow within the GPU process. Because the GPU process sits outside the renderer sandbox boundary, successful exploitation results in code execution with elevated privileges relative to the original renderer compromise.

Root Cause

The root cause is improper object lifetime management within ANGLE, classified as [CWE-416]. A resource is released while other code paths still hold references to it. When Chrome later accesses the dangling pointer through crafted WebGL or GPU commands from a malicious page, the attacker can shape the reused allocation to control function pointers or virtual table entries.

Attack Vector

Exploitation requires two stages. First, the attacker must already have compromised the renderer process, typically via a separate renderer-side vulnerability triggered by a crafted HTML or JavaScript payload. Second, the attacker uses the compromised renderer to issue crafted graphics commands that reach ANGLE and trigger the use-after-free. User interaction is required, since the victim must load the malicious page. Attack complexity is high because the exploit depends on a prior renderer compromise and precise heap manipulation inside the GPU process.

No public proof-of-concept or exploit code has been released for CVE-2026-87648. Refer to the Chromium Issue Tracker entry for technical context as Google releases additional detail after user patch adoption.

Detection Methods for CVE-2026-87648

Indicators of Compromise

Unexpected crashes or restarts of the Chrome GPU process (chrome.exe --type=gpu-process) accompanied by anomalous WER (Windows Error Reporting) entries.
Chrome child processes spawning non-graphics binaries such as cmd.exe, powershell.exe, or rundll32.exe.
Outbound network connections from a Chrome GPU or utility process to untrusted destinations shortly after visiting a new domain.

Detection Strategies

Monitor for browser process trees where a Chrome child process launches shell or scripting interpreters, a strong signal of sandbox escape.
Alert on Chrome versions in the environment reporting a build string below 153.0.8010.36 via endpoint inventory or browser management telemetry.
Correlate GPU process crashes with subsequent suspicious file writes to %LOCALAPPDATA% or persistence locations such as Run keys and scheduled tasks.

Monitoring Recommendations

Ingest Chrome crash telemetry and Windows Error Reporting events into your SIEM to detect ANGLE-related faults at scale.
Track WebGL and GPU feature usage from unmanaged or high-risk browsing sessions, particularly for users who handle sensitive data.
Deploy EDR behavioral rules that flag process injection or memory manipulation originating from browser child processes.

How to Mitigate CVE-2026-87648

Immediate Actions Required

Update Google Chrome on Windows to version 153.0.8010.36 or later across all managed endpoints.
Force-restart Chrome after deployment to ensure users pick up the patched binaries; pending updates do not take effect until relaunch.
Audit third-party Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream ANGLE fixes.

Patch Information

Google addressed CVE-2026-87648 in the Chrome Stable channel release documented in the Chrome Releases blog. The fix ships in Chrome 153.0.8010.36 for Windows. Enterprise administrators should validate deployment through Chrome Browser Cloud Management or their preferred patch management tooling.

Workarounds

Disable hardware acceleration in Chrome (chrome://settings → System → "Use graphics acceleration when available") to reduce reliance on ANGLE code paths, accepting rendering performance impact.
Restrict WebGL through enterprise policy by setting DefaultWebGLSetting to blocked for high-risk user populations until patches are fully deployed.
Use application allowlisting to prevent Chrome child processes from spawning shell or scripting binaries, limiting the impact of a successful sandbox escape.

bash

# Example Chrome enterprise policy fragment (Windows registry) to disable WebGL
# HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebGLSetting /t REG_DWORD /d 2 /f

# Verify Chrome version after patch deployment
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version