CVE-2026-87480

CVE-2026-87480 is a use-after-free (CWE-416) in the Printing component of Google Chrome, fixed in version 153.0.8010.36 and rated High (CVSS 8.3, Chromium severity High). To trigger it, a user must load a crafted HTML page, and the attacker must already have compromised the Chrome renderer process (e.g., by chaining a separate renderer bug), after which the printing bug corrupts freed memory. Successful exploitation potentially allows arbitrary code execution outside the Chrome sandbox, meaning code running with the browser's host privileges rather than confined to the sandbox. Anyone running a Chrome release prior to 153.0.8010.36 is affected, though the high attack complexity and required user interaction temper practical risk. No public proof-of-concept, KEV listing, or known in-the-wild exploitation exists; EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Update Chrome to 153.0.8010.36 or later and restart the browser to apply the fix; verify the running version via chrome://settings/help (or chrome://version). Enterprises should force the update through Chrome update management or MDM rather than relying on individual users. Because the bug only yields out-of-sandbox execution after a renderer compromise, keeping Chrome fully patched against other renderer bugs is important defense in depth.