CVE-2026-87512 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-9707 represents a critical memory safety flaw within the ANGLE graphics library, which is integrated into Google Chrome on Windows platforms prior to version 153.0.8010.36. This issue stems from an improper handling of dynamically allocated memory where a pointer continues to be used after its associated memory has been freed. In software engineering terms, this is classified as a use-after-free error, which falls under the Common Weakness Enumeration category CWE-416. Such vulnerabilities typically arise when developers fail to properly manage object lifecycles or neglect to nullify pointers immediately following deallocation operations. The ANGLE library serves as an abstraction layer that translates OpenGL ES calls into native graphics APIs like DirectX and Vulkan, making it a central component in Chrome's rendering pipeline for web content.
The operational impact of this vulnerability is severe because it allows remote code execution outside the browser sandbox environment. Attackers can craft malicious HTML pages containing specially designed JavaScript or WebGL shaders that trigger the use-after-free condition during the graphics processing phase. When the browser processes these crafted inputs, the freed memory may be reallocated for a different purpose while still being referenced by the original pointer. This discrepancy enables an attacker to manipulate program flow and execute arbitrary commands with the privileges of the compromised process. The severity is rated as High within the Chromium security framework due to the potential for full system compromise if sandbox escape techniques are successfully combined with this memory corruption flaw.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1203, which covers Exploitation for Client Execution. The attack vector is primarily remote via web content, requiring user interaction such as visiting a malicious website or opening an email attachment containing the crafted HTML page. Once executed, the attacker gains control over the browser process and can potentially pivot to other systems on the network if additional lateral movement techniques are employed. The existence of this flaw highlights the ongoing challenges in maintaining memory safety within complex C++ codebases that handle untrusted web content.
Mitigation strategies focus primarily on timely software updates. Administrators should ensure that all Windows-based Chrome installations are upgraded to version 153.0.8010.36 or later, where this issue has been resolved through improved memory management practices within the ANGLE component. For environments where immediate patching is not feasible, deploying web filtering solutions can help block access to known malicious domains hosting exploit kits. Additionally, enabling Chrome’s sandbox features and keeping them active ensures that even if an exploitation attempt succeeds, the damage remains confined to a restricted environment with limited system privileges. Regular security audits of third-party libraries integrated into browser engines are also recommended to identify similar memory safety issues before they can be exploited in production environments.