CVE-2026-87596

CVE-2026-87596 is an out-of-bounds read (CWE-125) in ANGLE, the graphics translation layer Google Chrome uses for GPU-accelerated rendering such as WebGL. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, causing ANGLE to read past a buffer boundary. The attacker gains the ability to read memory outside the Chrome sandbox, which is an information-disclosure issue (CVSS 4.3, medium, limited to confidentiality, though Chromium rates the bug High severity). Anyone running Google Chrome prior to 153.0.8010.36 is affected. There is no confirmed in-the-wild exploitation: EPSS puts the 30-day exploitation probability at roughly 0.2%, it is not in CISA KEV, and the only public reference is the Chromium issue tracker entry 536434693.

What to do: Update Chrome to 153.0.8010.36 or later and restart the browser (confirm via chrome://settings/help); administrators should verify fleet-wide versions and prioritize hosts whose users browse untrusted web content. No configuration mitigations are documented, but users on unpatched builds may reduce ANGLE attack surface by avoiding WebGL-heavy pages until they update.