Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML… (CVE-2026-87596)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : patch affected systems soon.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No other mitigation or temporary workaround is indicated.
Description
An out of bounds read vulnerability in the ANGLE component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability is classified as high severity by Chromium security. No CVSS score or patch information is currently provided.
Impact
The vulnerability allows remote attackers to read memory outside the sandbox, which may lead to exposure of sensitive information. The exact impact depends on the memory contents accessible during exploitation. No evidence of active exploitation in the wild is reported.
Summary
CVE-2026-87596 is an out of bounds read vulnerability in the ANGLE component of Google Chrome versions before 153.0.8010.36. The flaw enables a remote attacker to read memory outside the browser sandbox by using a specially crafted HTML page. This could potentially expose sensitive information from memory that should be protected by the sandboxing mechanism.
Weaknesses
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.