CVE-2026-87547
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)
Risk Assessment
The vulnerability may allow an attacker to execute code outside the sandbox, potentially leading to full system compromise or data integrity violation.
Recommendation
It is recommended to immediately update Google Chrome to version 153.0.8010.36 or later to mitigate this risk.
Other vulnerabilities in Google Chrome
See all- CVE-2026-87526Unknown
Use after free in Passwords in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could potentially execute arbitrary code outside the sandbox via UI Interaction. (Severity: Medium)
- CVE-2026-8581High
A use after free vulnerability in GPU in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8577High
Integer overflow in Fonts in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8575High
A use after free vulnerability in the UI in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
- CVE-2026-8573High
Integer overflow in Codecs in Google Chrome on Windows prior to version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
- CVE-2026-8569High
An out of bounds write in Codecs in Google Chrome on Mac prior to version 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.
- CVE-2026-8558High
In Google Chrome prior to version 148.0.7778.168, an out of bounds write in Fonts allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-8557High
In Google Chrome prior to version 148.0.7778.168, there was a use after free vulnerability in the Accessibility module that allowed a remote attacker who compromised the renderer process to perform privilege escalation via a crafted HTML page.
- CVE-2026-8555High
Use after free in GTK in Google Chrome on Windows prior to version 148.0.7778.168 allows a remote attacker to execute arbitrary code via a crafted HTML page.
- CVE-2026-8551High
A use after free vulnerability in Downloads in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted HTML page if a user engaged in specific UI gestures.
Original NVD description (English source)
Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)