CVE-2026-87604 in Chrome
Summary
by MITRE • 09/09/2026
Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within the ANGLE graphics library, present in versions of Google Chrome prior to 153.0.8010.36, represents a critical memory safety flaw with significant implications for browser security architecture. ANGLE serves as the translation layer between web applications and native GPU drivers, converting OpenGL ES commands into DirectX or Metal calls depending on the host operating system. This specific vulnerability arises from improper boundary checks during the processing of graphics primitives or shader operations within this translation layer. When a maliciously crafted HTML page containing specially constructed WebGL content is rendered, the browser fails to validate memory access limits correctly, leading to a read operation that extends beyond the allocated buffer boundaries. While out-of-bounds reads are typically associated with information disclosure vulnerabilities where an attacker might leak sensitive data from adjacent memory regions, in this specific context involving the renderer process and GPU interaction, the implications extend far beyond simple data leakage.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution outside the browser sandbox. Modern browsers employ a multi-process architecture with strict sandboxes designed to isolate untrusted web content from the underlying operating system. The renderer process, where ANGLE operates, is heavily restricted and cannot directly execute native code or access sensitive system resources without crossing security boundaries. However, an attacker who has already compromised the renderer process through this vulnerability can leverage the out-of-bounds read to gather precise memory layout information, such as heap addresses or function pointers. This data enables a sophisticated exploitation chain that bypasses common mitigations like Address Space Layout Randomization and Data Execution Prevention. By carefully crafting the exploit payload within the HTML page, an attacker can manipulate the browser's internal state to achieve arbitrary code execution in a context with higher privileges than the sandboxed renderer, effectively breaking out of the security perimeter established by Chrome’s isolation mechanisms.
From a classification perspective, this vulnerability aligns closely with CWE-125, which defines Out-of-bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. Furthermore, in terms of adversary tactics and techniques, this exploit path corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically when leveraging browser-based scripting environments for initial access, followed by T1203, Exploitation for Client Execution, as the ultimate goal is to execute code on the victim's machine. The severity rating of High from Chromium security reflects the critical nature of breaking out of the renderer sandbox, which is a fundamental defense-in-depth layer in modern web browsers. Successful exploitation allows an attacker to establish persistent access, install malware, or pivot further into internal networks if the compromised host has broader connectivity than the isolated browser process.
Mitigation strategies for this vulnerability primarily involve immediate software updates. Administrators and users must upgrade Google Chrome to version 153.0.8010.36 or later, where the boundary checks within ANGLE have been corrected to prevent invalid memory accesses during graphics processing operations. For organizations unable to patch immediately due to compatibility concerns, deploying browser isolation solutions such as Microsoft Edge IE Mode with strict security policies or third-party sandboxing tools can provide an additional layer of protection by limiting the impact of any renderer process compromise. Additionally, enabling Chrome’s built-in site isolation features ensures that even if a vulnerability is exploited in one tab, it cannot easily access data from other tabs running on different origins. Regular monitoring for new CVEs related to graphics libraries and keeping all browser components updated remains essential to maintaining robust defense against these complex exploitation chains.