CVE-2026-87588: Use After Free

Q: Who is exposed to this vulnerability?

Users of Google Chrome versions earlier than 153.0.8010.36 are exposed when they visit a crafted HTML page that triggers the flaw in Chromecast functionality.

Q: What does an attacker need to exploit it?

The attacker needs to cause a user to load a crafted HTML page. The reported impact is arbitrary code execution inside the Chrome sandbox.

Q: What version contains the fix?

Google Chrome 153.0.8010.36 addresses this vulnerability. Versions prior to that release are affected according to the available information.

Published Sep 9, 2026

Updated

Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of Google Chrome versions earlier than 153.0.8010.36 are exposed when they visit a crafted HTML page that triggers the flaw in Chromecast functionality.

What does an attacker need to exploit it?

The attacker needs to cause a user to load a crafted HTML page. The reported impact is arbitrary code execution inside the Chrome sandbox.

What version contains the fix?

Google Chrome 153.0.8010.36 addresses this vulnerability. Versions prior to that release are affected according to the available information.