CVE-2026-87448: Use After Free

Q: Which Chrome versions should be treated as affected?

Google Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.

Q: What attack delivery method is identified?

The vulnerability can be triggered by a remote attacker using a crafted HTML page. The issue is in DevTools and could permit code execution outside the Chrome sandbox.

Published Sep 9, 2026

Updated

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:10 AM

Data Sourced

via MITRE·12:10 AM

DescriptionWeakness

Frequently Asked Questions

Which Chrome versions should be treated as affected?

Google Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.

What attack delivery method is identified?

The vulnerability can be triggered by a remote attacker using a crafted HTML page. The issue is in DevTools and could permit code execution outside the Chrome sandbox.