CVE-2026-87602 in Chrome
Summary
by MITRE • 09/09/2026
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within the ANGLE graphics library in Google Chrome represents a significant, albeit low-severity, security flaw that impacts users on Windows operating systems prior to version 153.0.8010.36. This issue stems from improper boundary checks during memory access operations performed by the ANGLE component, which serves as the bridge between web applications and underlying hardware graphics APIs such as OpenGL or Vulkan. When a remote attacker crafts a malicious HTML page containing specific graphical instructions or shader code that triggers this flawed logic, the browser may attempt to read data from a memory location that lies outside the allocated buffer boundaries. This type of error is classified under CWE-125, which denotes out-of-bounds read vulnerabilities, and it highlights a failure in input validation where the application does not adequately verify that requested memory indices are within valid limits before execution.
From an operational perspective, this vulnerability allows for potential information disclosure by enabling a remote attacker to leak sensitive data from the browser's process memory space. Although Chromium classifies this issue with low severity due to the mitigating effect of Chrome’s sandboxing architecture, the risk remains non-negligible because sophisticated attackers may leverage such leaks in conjunction with other vulnerabilities or side-channel attacks to bypass security boundaries. The attacker can host a malicious webpage that exploits this flaw when visited by an unsuspecting user, thereby gaining unauthorized access to memory contents that should remain isolated within the sandboxed environment. This capability undermines the principle of least privilege and could potentially expose cookies, session tokens, or other sensitive information stored in browser memory if combined with additional exploitation techniques.
The technical root cause lies in the handling of graphics commands where array bounds are not strictly enforced during rendering operations. In many cases, these errors occur due to off-by-one mistakes or incorrect calculations regarding buffer sizes and offsets within the shader compilation or execution pipeline managed by ANGLE. The lack of rigorous validation allows for memory reads that extend beyond the intended allocation, leading to undefined behavior that can be exploited to extract data. This scenario aligns with ATT&CK technique T1057, which covers process discovery through local input capture, although in this specific context, it is more accurately mapped to information leakage via side channels or direct memory access attempts facilitated by browser engine flaws.
To mitigate the risks associated with this vulnerability, organizations and individual users must ensure that Google Chrome is updated to version 153.0.8010.36 or later on Windows systems. This update includes patches that enforce stricter boundary checks within the ANGLE library, preventing unauthorized memory reads from occurring during normal browsing activities. Additionally, deploying browser hardening policies such as disabling JavaScript in untrusted sites can reduce the attack surface by limiting the ability of remote attackers to execute crafted scripts that trigger these flaws. Regular security audits and adherence to secure coding practices for web content developers also play a crucial role in preventing similar issues from being introduced into applications that rely on complex graphics processing libraries like ANGLE.