CVE-2026-87634
A use‑after‑free bug in Chrome’s WebPackaging feature could let a malicious web page run code outside the browser sandbox. The flaw exists in versions before 153.0.8010.36. An attacker could exploit it to take control of the victim’s computer.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome users running versions older than 153.0.8010.36 on any supported operating system (Windows, macOS, Linux, Android).
Real-world impact
An attacker could execute arbitrary code on the victim’s machine, potentially stealing data, installing malware, or taking full control of the system.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network‑accessible, requires no special privileges, and allows an attacker to compromise confidentiality, integrity, and availability. The attack requires only that the victim view a crafted HTML page, making it highly exploitable.
What to do about it
- 01Update Google Chrome to version 153.0.8010.36 or later.
- 02Restart the browser to complete the update.
NVD description indicates update to 153.0.8010.36 or later
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/09/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/349994197permissions required