CVE-2026-87646

CriticalCVSS 9.6

Published: 09/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

Risk Assessment

Potential for remote code execution in the browser context, possibly leading to full system compromise.

Recommendation

Update Google Chrome to version 153.0.8010.36 or later.

Other vulnerabilities in Google Chrome

See all

CVE-2026-113344High
Use-after-free vulnerability in the Performance component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113343High
Memory corruption vulnerability in the Sandbox component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113339High
Use-after-free vulnerability in the SVG component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113338High
Use-after-free vulnerability in the Turbolev component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113337High
Memory corruption vulnerability in the Scroll component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113335High
Memory corruption vulnerability in the Extensions component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113332High
Memory corruption vulnerability in the GPU component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113327High
Use-after-free vulnerability in the Chromecast component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113324High
Use-after-free vulnerability in the GPU component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
CVE-2026-113322Unknown
Memory corruption in the Dawn component of Google Chrome prior to version 156.0.8078.47. A remote attacker could potentially read memory inside the sandbox via a crafted HTML page. Chromium severity: High.

Original NVD description (English source)

Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS