Loading vulnerability…
Out-of-bounds read in Google Chrome ANGLE
CVE-2026-87596 is a high-severity out-of-bounds read vulnerability in the ANGLE graphics component of Google Chrome before version 153.0.8010.36. Processing a crafted HTML page can allow a remote attacker to read memory outside the Chrome sandbox, resulting in information disclosure. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose memory outside the Chrome sandbox, potentially disclosing confidential information. The vulnerability-specific CVSS v3 vector indicates high confidentiality impact, with no indicated integrity or availability impact. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until updates are deployed, restrict use of affected browser installations and limit exposure to untrusted web content through web-content filtering and browser security controls. These measures reduce exposure but do not correct the out-of-bounds read. No vulnerability-specific workaround is identified.
Patch, then assume compromise.
Upgrade Google Chrome to version 153.0.8010.36 or later. For Debian stable (trixie), update Chromium to 153.0.8010.47-2~deb13u1 or later. For affected RHEL WebKitGTK installations, apply RHSA-2026:84584 on RHEL 8 or RHSA-2026:84583 on RHEL 9, providing webkit2gtk3 releases 2.54.1-1.el8_10 and 2.54.1-1.el9_8, respectively, and corresponding related packages. Other affected distributions should apply their vendor-provided package updates. Prisma Browser version 153.3.3.37 incorporates the fix for this CVE; version 155.16.5.40 or later addresses the complete October Chromium security advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.