External risk intelligence

Google Chrome WebGL Out of Bounds Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87650

The vulnerability exists in WebGL, a component of a widely used web browser. As web browsers are primary tools for accessing the public internet and frequently process untrusted content from remote web pages, the attack surface is commonly exposed to internet-based threats during normal user activity.

Out-of-bounds Read

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's WebGL component could allow a remote attacker to execute code outside the browser's safety boundaries by tricking a user into visiting a malicious webpage. This impacts a widely used technology, and while further analysis is needed to determine specific exposure, the potential for code execution warrants attention.

A flaw in Chrome's graphics handling.
Impacts broad internet browsing activity.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious web page. This page would contain specially crafted code that targets a flaw in the browser's WebGL component. If successful, this could allow the attacker to run their own code on the user's system, potentially leading to further compromise outside the browser's security boundaries.

Requires a user to visit a malicious website.
Triggered by a crafted HTML page.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an out-of-bounds read in WebGL could allow a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. This could affect sensitive information or service behavior.

Data or system asset at risk.
Exposure via crafted HTML page.
Potential for code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's WebGL component, which allows for potential arbitrary code execution outside the sandbox, likely requires action from browser administrators or endpoint security teams. The first practical step is to identify all Chrome instances within the environment, assess their exposure to external websites, and determine the business criticality of affected systems before planning remediation.

Browser administrators own this issue.
Verify Chrome reachability and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's WebGL component?

WebGL is a JavaScript API integrated into Google Chrome that enables the browser to render interactive 2D and 3D graphics. It allows web pages to use the computer's graphics hardware directly, powering complex visualizations, games, and UI elements without needing additional plugins.

What does an out-of-bounds read vulnerability mean in CVE-2026-87650?

This weakness, classified as CWE-125, occurs when software reads data past the end of an intended buffer. In this case, the browser processes memory incorrectly, which an attacker can manipulate to potentially bypass the sandbox and execute unauthorized code on your system.

How is this WebGL vulnerability triggered?

The vulnerability is triggered when a user visits a malicious website containing specially crafted HTML code designed to exploit the graphics processing flaw. Simply browsing to an innocuous or trusted page does not trigger the bug; it requires interaction with a page specifically engineered to deliver the malicious payload.

Do I need to worry if my systems use Google Chrome?

According to Halo Surface Signal, this vulnerability is classified as likely to impact your environment because web browsers are core tools for internet access. Since Chrome frequently handles untrusted content from the web, any system using an affected version to browse the internet faces an elevated risk of exposure.

What should I do first to address this security issue?

Begin by auditing your environment to identify all installations of Google Chrome running versions older than 153.0.8010.36. Prioritize systems that have frequent access to the internet, as these are the most likely to encounter the malicious web content required to exploit this flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.