CVE-2026-87621 in Chrome
Summary
by MITRE • 09/09/2026
Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds write within the ANGLE graphics library in Google Chrome represents a critical memory safety flaw that undermines the browser's core security architecture. ANGLE serves as the translation layer between web applications and native GPU drivers, converting OpenGL ES commands into DirectX or Vulkan calls depending on the host system. When processing crafted HTML content containing malicious JavaScript or WebGL shaders, this specific implementation error allows an attacker to write data beyond the boundaries of allocated memory buffers. This type of flaw is classified under CWE-787 as an out-of-bounds write, which is particularly dangerous because it can corrupt adjacent memory structures, overwrite function pointers, or modify control flow data such as return addresses on the stack.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution outside the browser's sandbox environment. Modern browsers rely heavily on process isolation and sandboxes to limit the damage caused by successful exploits. However, an out-of-bounds write in a privileged component like ANGLE can facilitate heap corruption techniques that allow attackers to escape these restrictions. By carefully crafting the payload within the HTML page, a remote attacker can manipulate memory layout to achieve code execution with higher privileges than those granted to the browser process itself. This effectively bypasses security mitigations such as Data Execution Prevention and Address Space Layout Randomization if the exploitation chain is sufficiently complex, leading to full system compromise rather than just local data theft or session hijacking.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1203, which covers Exploitation for Client Executable Attack, specifically targeting client software vulnerabilities in web browsers. The attack vector is remote and requires user interaction only to the extent of visiting a malicious webpage or loading compromised content via an iframe. This makes it highly suitable for drive-by download attacks where no additional social engineering beyond luring the victim to a site is required. The severity rating of High by Chromium security reflects the ease with which such memory corruption bugs can be chained into reliable exploit code, especially in complex rendering engines like Blink and ANGLE that handle untrusted input from web pages daily.
Mitigation strategies for this vulnerability primarily involve immediate patching through updating Google Chrome to version 153.0.8010.36 or later on Windows systems. Since the flaw resides in a core component of the browser, there are no effective client-side workarounds that do not compromise functionality. Organizations should enforce automated update policies for all endpoints running affected versions to ensure rapid remediation across their infrastructure. Additionally, deploying endpoint detection and response solutions with behavioral analysis capabilities can help identify anomalous memory access patterns or process injection attempts resulting from such exploits. Security teams should also monitor for indicators of compromise related to browser-based exploit kits that target known vulnerabilities in graphics libraries, ensuring that any successful exploitation is detected before lateral movement occurs within the network.