CVE-2026-87558: Use After Free

Q: Which systems are affected?

The issue affects Google Chrome on Mac before version 153.0.8010.36. The provided information does not identify impact on other operating systems.

Q: What does an attacker need to exploit this vulnerability?

An attacker needs to cause a victim to load a crafted HTML page remotely. Successful exploitation can result in arbitrary code execution outside the Chrome sandbox.

Q: Is this vulnerability exploitable through normal web browsing?

Yes. The described attack vector is a crafted HTML page, so exposure exists when a user visits attacker-controlled or otherwise malicious web content.

Published Sep 9, 2026

Updated

Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Which systems are affected?

The issue affects Google Chrome on Mac before version 153.0.8010.36. The provided information does not identify impact on other operating systems.

What does an attacker need to exploit this vulnerability?

An attacker needs to cause a victim to load a crafted HTML page remotely. Successful exploitation can result in arbitrary code execution outside the Chrome sandbox.

Is this vulnerability exploitable through normal web browsing?

Yes. The described attack vector is a crafted HTML page, so exposure exists when a user visits attacker-controlled or otherwise malicious web content.