CVE-2026-87643 in Chrome
Summary
by MITRE • 09/09/2026
Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an integer overflow within the GPU subsystem of Google Chrome on Android represents a critical failure in boundary checking during memory allocation or arithmetic operations related to graphics processing tasks. This flaw allows for the manipulation of internal data structures by supplying crafted input that exceeds expected numerical limits, leading to incorrect calculations regarding buffer sizes or array indices. When such an overflow occurs, it can result in heap corruption or out-of-bounds writes, which are fundamental prerequisites for achieving arbitrary code execution within a restricted environment. The severity is classified as medium because while the vulnerability provides a pathway to escape the browser's sandboxing mechanisms, successful exploitation typically requires specific conditions regarding GPU driver support and rendering contexts that may not be universally present across all devices or configurations.
From an operational perspective, this flaw enables a remote attacker to execute arbitrary code outside of Chrome's security sandbox by tricking a user into visiting a specially crafted HTML page containing malicious JavaScript and WebGL content. The attack vector relies on the browser's interaction with the underlying GPU drivers to process graphical commands. By exploiting the integer overflow, the attacker can corrupt memory structures in a way that allows for control flow hijacking or data injection. This effectively bypasses critical security mitigations such as sandboxing, which are designed to isolate web content from the rest of the operating system and user files. The impact is severe because it grants the adversary potential access to sensitive information stored on the device, including cookies, saved passwords, and other personal data that would otherwise remain protected by the browser's isolation policies.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-190 for Integer Overflow or Wraparound and potentially CWE-787 for Out-of-bounds Write if the overflow leads to memory corruption beyond allocated buffers. In terms of tactical mapping, this exploit technique corresponds to ATT&CK techniques related to privilege escalation and sandbox escape, specifically leveraging client-side execution vectors through web-based content delivery. The attack falls under the category of remote code execution via browser vulnerabilities, often categorized within initial access or persistence strategies depending on how the executed payload is utilized post-exploitation.
Mitigation for this vulnerability primarily involves updating Google Chrome to version 153.0.8010.36 or later on Android devices, as these updates contain patches that enforce stricter bounds checking and validate input parameters before passing them to GPU-related functions. Administrators should ensure automated update policies are in place to maintain the latest security fixes across all managed endpoints. Additionally, users can reduce risk by disabling JavaScript for untrusted sites or using browser extensions that restrict WebGL access, although these measures may impact functionality of legitimate web applications. Security teams should monitor for indicators of compromise related to unusual GPU process behavior and ensure that endpoint detection systems are configured to flag anomalous memory allocation patterns associated with browser processes.