CVE-2026-87510: Input Validation

Q: What does an attacker need before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. They can then use a crafted HTML page to potentially execute arbitrary code outside Chrome's sandbox.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: Are users exposed merely by browsing to a crafted page?

The crafted HTML page is part of the exploitation path, but the available information states that the renderer process must already be compromised. The data does not indicate that visiting a page alone is sufficient.

Published Sep 9, 2026

Updated

Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need before this issue can be exploited?

The attacker must first compromise the Chrome renderer process. They can then use a crafted HTML page to potentially execute arbitrary code outside Chrome's sandbox.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Are users exposed merely by browsing to a crafted page?

The crafted HTML page is part of the exploitation path, but the available information states that the renderer process must already be compromised. The data does not indicate that visiting a page alone is sufficient.