CVE-2026-87467

CVE-2026-87467 is a race condition (CWE-362) in the Google Updater component of Chrome for Windows, allowing a local attacker to potentially execute arbitrary code outside the browser sandbox. It is triggered when a local program, already running on the victim machine (e.g., malware or a low-privileged foothold), wins a timing race with updater operations and manipulates the update process. Successful exploitation yields code execution outside Chrome's sandbox, meaning the attacker escapes the browser's isolation boundary and runs with the privileges of the updater/user context. All Chrome installations on Windows prior to 153.0.8010.36 are affected; other platforms are not named in the advisory. There is currently no known public proof-of-concept, no entry in CISA's KEV catalog, and EPSS assigns only a 0.1% (1st percentile) probability of exploitation in the next 30 days, so exploitation status is 'none known'.

What to do: Update Chrome on Windows to 153.0.8010.36 or later and verify the current version at chrome://settings/help; enterprise admins should enforce the minimum browser version via update management policies. Because the flaw requires an attacker to already run a program locally, prioritize patching on shared, multi-user, or remotely accessible endpoints and confirm the Google Updater component picked up the patched build after the browser update.