CVE-2026-87512

CVE-2026-87512 is a use-after-free (CWE-416) in ANGLE, the graphics translation layer Chrome uses for WebGL, in Google Chrome on Windows; Chromium rates it High and CVSS 3.1 scores it 9.6 (critical). It is triggered when the browser processes a crafted HTML page, which requires user interaction such as visiting an attacker-controlled site, and it lets the attacker execute arbitrary code outside the Chrome sandbox, i.e., escape from the web-content sandbox. Any Chrome user on Windows running a version before 153.0.8010.36 is affected; other platforms are not named in the advisory. The CVE record lists no public proof-of-concept and the flaw is not yet in CISA KEV, but reporting on the Chrome 153 release (230 security fixes) indicates a zero-day exploited in the wild was patched in the same release, so defenders should treat active exploitation as plausible. EPSS currently estimates only a 0.4% probability of exploitation within 30 days (29th percentile), so patching urgency is driven by the bug's severity and the reported in-the-wild zero-day in this release.

What to do: Update Google Chrome on Windows to 153.0.8010.36 or later immediately (Help > About Chrome applies the update, then relaunch the browser) and verify fleet versions via enterprise management tooling. Until patched, limit exposure to untrusted sites and consider disabling WebGL as a stopgap; monitor for the CVE's addition to CISA KEV and for confirmation that it is the zero-day reportedly exploited in the wild.