CVE-2026-87520: Use After Free
Published Sep 9, 2026
·Updated
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Affected Software
1 affected component
Google Dawn (in Google Chrome for Android)<153.0.8010.36
Event History
Sep 9, 2026
CVE Published
via MITRE·12:09 AM
Data Sourced
via MITRE·12:09 AM
DescriptionWeakness
Frequently Asked Questions
1
Which devices are affected?
The issue affects Google Chrome for Android using versions earlier than 153.0.8010.36. The vulnerable component is Dawn in Chrome.
2
What does an attacker need to exploit this issue?
An attacker needs to induce a user to load a crafted HTML page remotely. Successful exploitation can execute arbitrary code outside Chrome's sandbox.
3
How can I determine whether remediation is needed?
Check the installed Google Chrome version on Android. Versions prior to 153.0.8010.36 require updating.