Critical· 9.6official fix available
CVE-2026-87621
A flaw in Google Chrome’s ANGLE component on Windows allows a remote attacker to write data outside the intended memory area, potentially running code outside the browser sandbox.
publishedSep 9, 2026
last modifiedSep 10, 2026
sourcesNVD
severity · cvss
9.6
critical · how bad it is
exploitation · epss
<1%
25th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 9, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Google Chrome users on Windows using versions earlier than 153.0.8010.36.
02
Real-world impact
An attacker could craft a malicious web page that, when viewed, could execute arbitrary code on the victim’s computer, bypassing the browser’s security sandbox.
03
Why this severity
The CVSS score of 9.6 reflects the vulnerability’s ability to be exploited remotely with no user interaction, giving the attacker full control over the system.
04
What to do about it
official fix available
recommended steps
- 01Update Google Chrome to version 153.0.8010.36 or later.
- 02Restart the browser to apply the update.
NVD description
05
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- chromereleases.googleblog.com/2026/09/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/536664909permissions required
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →