https://seclists.org/oss-sec/2026/q3/710: CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36

Q: What does an attacker need to exploit this issue?

The issue can be triggered remotely through a crafted HTML page. The reported impact is arbitrary code execution outside the browser sandbox.

Q: Which versions are known to be vulnerable?

Google Chrome versions prior to 153.0.8010.36 are affected. Debian lists all current Chromium packages as vulnerable.

Q: Are Chromium-based browsers other than Chrome affected?

The provided data identifies Chromium and notes that the flaw is in WebGL, but it does not confirm the status of every Chromium-derived browser. Administrators should verify vendor-specific advisories and package status for their deployed browser.

Published Sep 10, 2026

Updated

Affected Software

2 affected components

Google Chrome<153.0.8010.36

Chromium<153.0.8010.36

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue can be triggered remotely through a crafted HTML page. The reported impact is arbitrary code execution outside the browser sandbox.

Which versions are known to be vulnerable?

Google Chrome versions prior to 153.0.8010.36 are affected. Debian lists all current Chromium packages as vulnerable.

Are Chromium-based browsers other than Chrome affected?

The provided data identifies Chromium and notes that the flaw is in WebGL, but it does not confirm the status of every Chromium-derived browser. Administrators should verify vendor-specific advisories and package status for their deployed browser.