CVE-2026-87643
An integer overflow in the GPU code of Google Chrome on Android allows a remote attacker to run code outside the browser sandbox by loading a specially crafted web page. The flaw can be triggered over the network and does not require any user interaction beyond opening the page. It is a critical vulnerability with a CVSS score of 9.6.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome for Android versions earlier than 153.0.8010.36.
Real-world impact
An attacker could execute arbitrary code on the victim’s device, potentially taking full control of the system, stealing data, or installing malware, all without the user’s knowledge.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is exploitable over the network (AV:N), requires low effort (AC:L), no privileges (PR:N), and only a user’s interaction with a web page (UI:R). The scope change (S:C) and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) further raise the score.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/09/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/513416699permissions required