External risk intelligence

ANGLE Out of Bounds Write Vulnerability in Google Chrome Leads to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87621

The vulnerability exists within the client-side browser engine (ANGLE in Google Chrome). Exploitation requires a user to navigate to a crafted HTML page, meaning it is not a public-facing service, gateway, or network-accessible management interface, but rather a client-side component reliant on user interaction.

Out-of-bounds Write

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Google Chrome's ANGLE component on Windows could allow a remote attacker to execute code outside the browser's security sandbox by tricking a user into visiting a malicious webpage. While the risk is mitigated by requiring user interaction, it's important to understand the potential impact of such weaknesses in widely used software.

Malicious webpages can bypass browser security.
Critical flaw could affect many users.
Confirm relevance and exposure for Chrome users.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would contain specially crafted HTML designed to trigger an out-of-bounds write vulnerability within ANGLE, a component of Google Chrome. Successful exploitation could allow the attacker to execute code on the user's system, bypassing security restrictions.

Entry condition: User visits a malicious webpage.
Trigger point: Crafted HTML page interacts with ANGLE.
Resulting risk: Arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a specially crafted HTML page. This could potentially affect the confidentiality, integrity, and availability of the user's system when running the affected browser.

System code execution outside sandbox.
User visits malicious HTML page.
Arbitrary code execution on user's machine.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ANGLE component in Google Chrome is affected by an out-of-bounds write vulnerability. This impacts client-side operations, requiring user interaction with a crafted HTML page for exploitation, rather than direct exposure of a service. Platform or security teams should identify Chrome installations and coordinate with vendor management if specific versions are in scope.

Platform and security teams own this.
Verify Chrome browser deployment and version.
Coordinate vendor updates and user communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an open-source graphics engine used by Google Chrome to translate standard graphics API calls, such as OpenGL, into the native graphics APIs provided by the underlying Windows operating system. It acts as a translator, ensuring that browser-based content like 3D games or interactive web graphics displays correctly and efficiently regardless of the computer's specific hardware or drivers.

What does an out-of-bounds write vulnerability mean in CVE-2026-87621?

This weakness, categorized as CWE-787, occurs when a program writes data past the end or before the beginning of its intended memory buffer. In the context of this CVE, it means the browser's graphics engine can be tricked into overwriting adjacent areas of system memory. This is dangerous because an attacker may use these overwritten areas to inject and execute their own malicious code, effectively bypassing the browser's security boundaries.

How is this vulnerability triggered?

The vulnerability is triggered when a user navigates to a specifically crafted HTML page that interacts with the ANGLE component in a way that causes the memory corruption. It is important to note that simply having the browser installed or running does not trigger the bug; the system must actively process malicious web content, which requires the browser engine to interpret the specifically designed input.

Is this vulnerability exposed to the internet?

According to Halo Surface Signal, this is not a public-facing service or a network-accessible management interface. Because the flaw resides in a client-side browser component, the attack surface is limited to instances where a user actively interacts with a malicious webpage. It is considered a client-side risk rather than a server-side exposure, meaning attackers cannot target your infrastructure remotely without user participation.

What should I do if I use Google Chrome on Windows?

The primary response is to ensure your browser is updated to the latest available version provided by the vendor. Since this is a client-side issue, verifying the deployment of the updated Chrome version across your systems is the most effective way to address the flaw. Coordinate with your standard software update processes to ensure all instances are moved to version 153.0.8010.36 or higher to resolve the underlying security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.