CVE-2026-87464
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)
Risk Assessment
This critical vulnerability could allow an attacker to fully compromise the system, posing a serious threat to data confidentiality, integrity, and availability.
Recommendation
Immediately update Google Chrome to version 153.0.8010.36 or later to prevent potential exploitation.
Other vulnerabilities in Google Chrome
See all- CVE-2026-113344High
Use-after-free vulnerability in the Performance component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113343High
Memory corruption vulnerability in the Sandbox component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113339High
Use-after-free vulnerability in the SVG component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113338High
Use-after-free vulnerability in the Turbolev component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113337High
Memory corruption vulnerability in the Scroll component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113335High
Memory corruption vulnerability in the Extensions component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113332High
Memory corruption vulnerability in the GPU component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113327High
Use-after-free vulnerability in the Chromecast component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113324High
Use-after-free vulnerability in the GPU component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-113322Unknown
Memory corruption in the Dawn component of Google Chrome prior to version 156.0.8078.47. A remote attacker could potentially read memory inside the sandbox via a crafted HTML page. Chromium severity: High.
Original NVD description (English source)
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS