CVE-2026-87654
A buffer overflow in the ANGLE component of Google Chrome on Windows allows a remote attacker to run code outside the browser sandbox by loading a specially crafted web page. The flaw is exploitable over the network and requires no user privileges, but the victim must open the malicious page.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome for Windows versions earlier than 153.0.8010.36.
Real-world impact
An attacker could execute arbitrary code on the victim’s computer, potentially taking full control of the system, stealing data, or installing malware, all from a malicious web page.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is network‑accessible (AV:N), easy to exploit (AC:L), requires no privileges (PR:N), needs the user to open a page (UI:R), changes the scope of the affected system (S:C), and has high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
- 01Upgrade Google Chrome to version 153.0.8010.36 or later.
- 02Restart the browser to complete the update.
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/09/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/536444790permissions required