External risk intelligence

Chrome ANGLE Buffer Overflow Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87654

This vulnerability exists within the browser client software itself, specifically affecting client-side rendering components. It requires a user to navigate to a crafted HTML page, meaning it is not a service, gateway, or internet-facing infrastructure component that would be exposed or reachable on the network in a typical server-side deployment.

Buffer Overflow

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in ANGLE, a component of Google Chrome on Windows, allows for arbitrary code execution if a user visits a malicious webpage. This could potentially impact user data and system integrity.

Code execution risk on user devices.
High severity, affects broad user base.
Confirm if this impacts our user base.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would contain specially crafted HTML designed to trigger a buffer overflow vulnerability within the ANGLE component of Google Chrome. If successful, this could allow the attacker to run their own code on the user's computer, potentially bypassing security restrictions.

Entry condition: User visits a malicious webpage.
Trigger point: Crafted HTML page interacts with ANGLE.
Resulting risk: Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow in ANGLE within Google Chrome on Windows could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page. This means sensitive information, system data, or service behavior could be impacted if the vulnerability is exploited under these conditions.

System data and user data could be affected.
Exploitation could occur via a crafted HTML page.
Arbitrary code execution outside the sandbox is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in ANGLE, affecting Google Chrome on Windows, requires immediate attention from teams responsible for browser deployments and user endpoint security. The initial step is to identify all endpoints running the affected Chrome version, determine their exposure and criticality, and pinpoint the accountable owner for remediation. Coordination with vendor management may be necessary if this is a managed browser service.

Identify affected Chrome instances.
Confirm reachability and criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ANGLE component in Google Chrome?

ANGLE is an open-source graphics engine abstraction layer within Chromium. It translates industry-standard graphics API calls, such as OpenGL ES, into the native APIs supported by the underlying operating system—in this case, Windows. It allows Chrome to render web-based graphics, animations, and 3D content efficiently across different hardware.

What does CWE-122 mean in the context of CVE-2026-87654?

CWE-122 refers to a Heap-based Buffer Overflow. This is a memory-related weakness where software writes more data to a specific memory area than it is designed to hold. In this CVE, the flaw exists within the ANGLE graphics component; if triggered, it corrupts adjacent memory, potentially allowing an attacker to overwrite program logic and run their own unauthorized code.

How is this Chrome vulnerability triggered?

The vulnerability is triggered when a user navigates to a webpage containing specific, maliciously crafted HTML designed to exploit the memory overflow. It does not trigger simply by having Chrome installed or running in the background. The exploit process relies on the browser attempting to process or render the harmful code contained within the webpage's data structures.

Is my server infrastructure at risk from this Chrome flaw?

According to Halo Surface Signal, this vulnerability is very unlikely to affect server infrastructure. Because it exists within the browser's client-side rendering engine, it requires a user to interact with a page through the Chrome interface. It is not a network-accessible service or gateway that would typically be exposed on a server-side deployment.

What should I do if I am running Google Chrome on Windows?

Your first step is to identify which endpoints in your organization are running versions of Chrome older than 153.0.8010.36. Once identified, prioritize these systems for the standard vendor-provided update process. Since this affects user devices, coordinate with the teams managing endpoint security and browser deployments to ensure the latest patches are applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.