CVE-2026-87654 in Chrome
Summary
by MITRE • 09/09/2026
Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-7966 represents a critical security flaw within the ANGLE graphics library, which is integrated into Google Chrome on Windows systems prior to version 153.0.8010.36. This buffer overflow condition arises from improper handling of memory allocation and bounds checking during the processing of graphical data structures. When an attacker crafts a malicious HTML page that triggers specific rendering operations within ANGLE, they can exploit this flaw to write beyond the allocated boundaries of a buffer in memory. The severity of this issue is classified as High by Chromium security standards due to its potential for remote code execution with elevated privileges relative to the browser sandbox environment.
From a technical perspective, the root cause lies in how ANGLE translates high-level graphics commands into low-level OpenGL or Vulkan calls on Windows systems. If input data derived from web content is not rigorously validated before being passed to underlying system libraries, it can lead to heap-based buffer overflows. This type of memory corruption allows an attacker to overwrite adjacent memory structures, potentially including function pointers or exception handling records. By carefully crafting the payload within the HTML page, specifically through embedded scripts and complex CSS animations that trigger specific rendering paths, a remote user can manipulate the control flow of the browser process. The exploitation typically involves calculating precise offsets to hijack execution flow, thereby bypassing standard memory protection mechanisms such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) if combined with additional information disclosure vulnerabilities.
The operational impact of this vulnerability is severe because it facilitates remote code execution outside the browser's sandbox. Modern browsers rely heavily on sandboxing to isolate web content from the operating system and user data, thereby limiting the damage an attacker can cause even after successful exploitation. However, by escaping the sandbox via a buffer overflow in ANGLE, an attacker gains the ability to execute arbitrary code with the same privileges as the browser process itself. This level of access allows for further lateral movement within the victim's environment, installation of persistent malware, theft of sensitive credentials stored in memory or on disk, and complete compromise of the host system. The attack vector is remote, meaning no user interaction beyond visiting a maliciously crafted website is required to initiate the exploit chain.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-120, which describes buffer copy without checking size limits, specifically manifesting as a heap-based overflow in this context. In terms of attack tactics and techniques, it maps directly to MITRE ATT&CK technique T1203, known as Exploitation for Client Execution, where attackers leverage software vulnerabilities on client systems to execute malicious code. The exploitation path also touches upon privilege escalation concepts found in T1068, although the primary mechanism is sandbox escape rather than traditional local privilege escalation via kernel flaws. Defenders should note that such exploits often serve as initial access vectors in targeted campaigns aimed at high-value targets or widespread credential harvesting operations.
Mitigation strategies primarily involve immediate patching of Google Chrome to version 153.0.8010.36 or later, which includes fixes for the underlying memory management issues within ANGLE. Organizations should enforce automated update policies to ensure all endpoints are protected against known browser vulnerabilities. Additionally, implementing application control solutions can help prevent unauthorized code execution even if a sandbox escape occurs by restricting what processes can run on the system. Network-level defenses such as web filtering proxies can also be configured to block access to domains hosting malicious content or exhibiting patterns consistent with exploit kit behavior. Security awareness training remains relevant for educating users about the risks of visiting untrusted websites, although technical controls are essential given that this vulnerability requires no user interaction beyond page load.