ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-87438

mass

Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE

CVSS 3.1
9.6 critical
EPSS
<1%p44
Published
()
Modified
AI analysis

CVE-2026-87438 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, requiring no privileges and only user interaction. Successful exploitation yields arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's renderer sandbox and compromises the device at a level beyond the web content, with high confidentiality, integrity and availability impact. Users of Chrome on Android prior to 153.0.8010.36 are affected; the fix ships in Chrome 153, a release that includes roughly 230 security fixes. Exploitation of this specific WebGL flaw has not been documented so far (not in CISA KEV, EPSS ~0.4%, no public PoC); the actively exploited zero-day referenced in recent headlines is a separate V8 bug that was patched in the same Chrome 153 release.

What to do: Update Chrome on Android to 153.0.8010.36 or later (Play Store > Settings > About Chrome, or rely on auto-update) and confirm managed/fleet Android devices have received the update. As interim mitigation, avoid opening untrusted web pages until patched. Note that Chrome 153 also fixes an actively exploited V8 zero-day, so applying this update promptly is important regardless of this bug's exploitation status.

Affected
Google Chrome (on Android)All versions prior to 153.0.8010.36; fixed in 153.0.8010.36
Estimated exposure
mass≈ billions of users (Chrome for Android is the default/primary browser on the world's largest mobile OS) — Chrome reports over 3 billion users globally and Android's dominant mobile market share means the overwhelming majority are on Android, where every device running a pre-153 Chrome build is exposed until updated.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Vendors
google
Products
chrome
Weakness
CWE-787
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.

Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.

The Hacker News · 6d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+10 CVEs

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.

GBHackers · 6d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+19 CVEs

Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild

Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.

Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.

Cyber Security News · 6d agoVulnerability in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+7 CVEs1