CVE-2026-87506: Google Chrome vulnerability

Q: What does an attacker need before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. The issue is then triggered through a crafted HTML page and may allow code execution outside the sandbox.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: Is this a standalone remote code execution issue from simply visiting a page?

The provided information describes it as requiring a compromised renderer process first. It does not state that visiting a crafted page alone is sufficient to exploit the vulnerability.

Published Sep 9, 2026

Updated

Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. The issue is then triggered through a crafted HTML page and may allow code execution outside the sandbox.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Is this a standalone remote code execution issue from simply visiting a page?

The provided information describes it as requiring a compromised renderer process first. It does not state that visiting a crafted page alone is sufficient to exploit the vulnerability.