CVE-2026-87455: Use After Free

Q: Who is exposed to this vulnerability?

Users of Google Chrome versions prior to 153.0.8010.36 are affected when they visit a crafted HTML page controlled by an attacker.

Q: What does an attacker need to exploit it?

The attacker needs to cause the target to load a crafted HTML page remotely. The reported impact is potential arbitrary code execution outside the Chrome sandbox.

Q: What version resolves the issue?

Update Google Chrome to version 153.0.8010.36 or later.

Published Sep 9, 2026

Updated

Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of Google Chrome versions prior to 153.0.8010.36 are affected when they visit a crafted HTML page controlled by an attacker.

What does an attacker need to exploit it?

The attacker needs to cause the target to load a crafted HTML page remotely. The reported impact is potential arbitrary code execution outside the Chrome sandbox.

What version resolves the issue?

Update Google Chrome to version 153.0.8010.36 or later.