External risk intelligence

ANGLE Use After Free Vulnerability in Chrome on Windows

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87512

This vulnerability affects a client-side web browser application. It requires a user to navigate to a crafted HTML page, meaning it is not a service that is internet-facing by design or reachable without specific user interaction in a client-side environment.

Use After Free

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a specific type of error in how ANGLE, a graphics component used in Google Chrome, handles memory on Windows. If exploited, it could allow an attacker to run malicious code on a user's computer. The primary concern is to confirm if our environment uses the affected technology and if there is any potential exposure.

Memory error in browser graphics component.
Confirms need to check for relevant exposure.
Prioritize understanding potential impact to users.

Attack Path

How an attacker could exploit the issue

An attacker can trick a user into visiting a malicious webpage that exploits a use-after-free flaw in ANGLE, a graphics engine within Google Chrome. By successfully triggering this vulnerability, an attacker could gain the ability to execute arbitrary code, potentially bypassing security restrictions.

Requires user interaction with a malicious page.
Triggered by a crafted HTML page.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in ANGLE, a component of Google Chrome, could allow a remote attacker to execute arbitrary code outside the sandbox. This could occur when a user visits a specially crafted HTML page.

Arbitrary code execution outside the sandbox.
User visits a crafted HTML page.
Compromise of the user's system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, impacting Google Chrome, likely involves application owners and potentially infrastructure or platform teams responsible for the browser deployment. The immediate first step is to identify all instances of the affected Chrome version, confirm if they are business-critical, and ascertain the specific owner responsible for remediation.

Identify affected Chrome deployments.
Confirm exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is a graphics abstraction layer within Chromium that translates industry-standard graphics API calls, such as OpenGL ES, into the native APIs used by the host operating system. In the context of Chrome on Windows, it enables the browser to efficiently render complex web-based graphics, 3D content, and hardware-accelerated interfaces by interfacing directly with the computer's graphics hardware drivers.

What does CVE-2026-87512 mean by use-after-free?

This is a memory management weakness known as CWE-416. It occurs when a program continues to use a memory address after that memory has been cleared or released. If an attacker can manipulate the system into reusing that freed space with malicious data while the software still attempts to access it, they can hijack the software's execution flow to perform unintended actions.

How is this Chrome vulnerability triggered?

An attacker must successfully lure a user into navigating to a specifically crafted HTML page designed to exploit the memory handling error. The bug is not triggered by simply having the browser installed or running; it requires the active interaction of a user visiting the malicious site for the exploit sequence to execute.

Is my system at risk for this CVE-2026-87512?

Halo Surface Signal notes that this is a client-side browser vulnerability, making it 'Very unlikely' to be exploited like a traditional internet-facing service. Because it requires user action—navigating to a malicious webpage—the risk is tied to how users browse the web rather than exposed network ports or services that are reachable by attackers without interaction.

Do I need to take action if I use Chrome on Windows?

Yes. First, identify all machines in your environment running versions of Chrome older than 153.0.8010.36. Once identified, ensure these instances are updated to the latest stable release provided by the vendor. Prioritize updating workstations used for critical business tasks to minimize the potential impact of arbitrary code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.