CVE-2026-87650
A flaw in Chrome’s WebGL implementation lets a remote attacker run code outside the browser sandbox by loading a specially crafted web page. The bug is an out‑of‑bounds read that could lead to arbitrary code execution. It is rated critical.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome browsers older than version 153.0.8010.36, on any platform.
Real-world impact
An attacker could run malicious code on the victim’s machine, potentially taking full control, stealing data, installing malware, or using the system for further attacks.
Why this severity
The CVSS score of 9.6 reflects the high impact on confidentiality, integrity, and availability, the fact that the vulnerability can be exploited remotely with no authentication, and that it only requires a user to visit a malicious web page.
What to do about it
- 01Upgrade Google Chrome to version 153.0.8010.36 or later.
- 02Restart the browser to apply the update.
NVD description indicates fix in version 153.0.8010.36
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/09/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/534912743permissions required