CVE-2026-87648

CVE-2026-87648 is a use-after-free vulnerability (CWE-416) in ANGLE, the graphics translation layer Chrome uses on Windows to convert OpenGL/WebGL calls to native graphics APIs. It is triggered by a crafted HTML page (typically involving WebGL or GPU-accelerated rendering) and, per the Chromium advisory, it requires the attacker to first have compromised the renderer process, meaning it functions as a sandbox-escape bug to be chained with another flaw. An attacker who exploits it gains the ability to execute arbitrary code outside the Chrome sandbox, escalating from a renderer-level compromise to broader system access. All users of Google Chrome on Windows running versions prior to 153.0.8010.36 are affected; non-Windows platforms are not named in the advisory. Exploitation status: no known in-the-wild exploitation, no public proof-of-concept, not listed in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update Google Chrome on Windows to version 153.0.8010.36 or later; users can verify their version via chrome://version, and administrators should push the update through enterprise browser management. Because this bug is most valuable as part of an exploit chain (it requires an already-compromised renderer), also ensure all other Chrome security updates are applied promptly. No workarounds are documented, but disabling WebGL could reduce exposure to the ANGLE attack surface if immediate patching is not possible.