CVE-2026-87488

CVE-2026-87488 is a use-after-free (CWE-416) in the WebGL component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. A remote attacker triggers it by luring a user to open a crafted HTML page in a vulnerable Chrome for Android build. Successful exploitation allows the attacker to execute arbitrary code outside the browser's sandbox, meaning code runs beyond the browser's security boundary on the device. All Chrome for Android users running versions prior to 153.0.8010.36 are affected. No public proof-of-concept is known and the flaw is not in CISA's KEV, with EPSS assigning a 0.4% 30-day exploitation probability; note that the same Chrome 153 release fixes 230 issues, including a separate, actively exploited V8 zero-day (code execution inside the sandbox) that should not be confused with this WebGL bug.

What to do: Update Chrome for Android to 153.0.8010.36 or later via the Google Play Store, and verify managed fleets through MDM/EMM browser version reporting. Because this flaw allows code execution outside the sandbox, treat it as critical and patch promptly, especially since the same 153 release also addresses an actively exploited V8 zero-day. Until devices are patched, avoid opening untrusted links or web content in Chrome on Android.