CVE-2026-87654 Overview
CVE-2026-87654 is a heap buffer overflow [CWE-122] in the ANGLE graphics abstraction layer used by Google Chrome on Windows. Versions of Chrome prior to 153.0.8010.36 are affected. A remote attacker can trigger the overflow by serving a crafted HTML page and execute arbitrary code outside the Chrome sandbox. Google's Chromium security team rates the underlying issue as High severity, and the CVE carries a Critical CVSS rating due to the sandbox escape.
Critical Impact
Successful exploitation grants arbitrary code execution outside the Chrome sandbox on Windows hosts, giving attackers a foothold in the user context after a single visit to a malicious page.
Affected Products
- Google Chrome for Windows prior to 153.0.8010.36
- Microsoft Windows desktop platforms running vulnerable Chrome builds
- Chromium-derived browsers on Windows that embed the affected ANGLE component
Discovery Timeline
- 2026-09-09 - CVE-2026-87654 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87654
Vulnerability Analysis
The flaw resides in ANGLE, the Almost Native Graphics Layer Engine that translates OpenGL ES API calls into Direct3D on Windows. ANGLE runs inside Chrome's GPU process, which historically has a weaker sandbox boundary than the renderer. A malformed sequence of WebGL or graphics API calls from an attacker-controlled page corrupts a heap allocation inside ANGLE. Because the exploitation path executes in the GPU process rather than the sandboxed renderer, successful memory corruption yields code execution outside the renderer sandbox.
The issue is reachable from any origin that can serve HTML and issue WebGL draw calls, so drive-by compromise via advertising networks or watering-hole pages is realistic. User interaction is limited to visiting the page.
Root Cause
The root cause is a heap-based buffer overflow classified under [CWE-122]. ANGLE writes past the bounds of a heap-allocated buffer while processing attacker-influenced graphics data, corrupting adjacent heap metadata or object pointers. Google has not publicly released the specific function or commit to limit weaponization while patch adoption progresses. Details are tracked in the Chromium Issue Tracker Entry.
Attack Vector
Exploitation is network-based and requires the victim to load a crafted HTML page in a vulnerable Chrome build. The page issues specifically crafted WebGL or graphics API calls that reach the vulnerable ANGLE code path in the GPU process. Because the overflow allows escape from the sandbox, the attacker can execute code in the security context of the browser process user account. No prior authentication is required.
No public proof-of-concept is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-87654
Indicators of Compromise
- Chrome GPU process (chrome.exe --type=gpu-process) crashes or unexpected restarts following navigation to untrusted pages
- Child processes spawned by chrome.exe that are inconsistent with normal browser behavior, such as command interpreters or script hosts
- Outbound network connections from Chrome-spawned processes to previously unseen infrastructure shortly after page load
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 153.0.8010.36
- Alert on anomalous process lineage where chrome.exe GPU process is the parent of non-browser executables
- Correlate Chrome crash telemetry with web proxy logs to identify pages that consistently trigger GPU process termination
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a central data lake to enable retrospective hunts for suspicious Chrome child processes
- Monitor Windows Error Reporting and application crash events referencing libGLESv2.dll or ANGLE modules
- Track outbound egress from user endpoints for beacons initiated in temporal proximity to browser crashes
How to Mitigate CVE-2026-87654
Immediate Actions Required
- Update Google Chrome on Windows to version 153.0.8010.36 or later on all managed endpoints
- Force-restart Chrome sessions after deployment so the patched binaries load into memory
- Audit Chromium-based third-party browsers for equivalent ANGLE updates and apply vendor patches
Patch Information
Google addressed the issue in the Chrome Stable channel at version 153.0.8010.36 for Windows. Deployment details are documented in the Chrome Desktop Update Announcement. Enterprises using Chrome Browser Enterprise policies should confirm the TargetVersionPrefix policy does not pin devices to a vulnerable release.
Workarounds
- Disable hardware acceleration in Chrome to reduce the ANGLE attack surface where patching is delayed
- Restrict WebGL through enterprise policy on high-risk endpoints until updates are staged
- Route browsing through isolation or remote browser infrastructure for users who cannot receive the patch immediately
# Configuration example: disable hardware acceleration via Chrome enterprise policy (Windows)
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f
# Pin managed fleet to the patched version or later
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.36" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
