CVE-2026-87506

Google Chrome versions prior to 153.0.8010.36 contain a privilege elevation flaw (CWE-250) in the WebUI component that allows code to escape the browser sandbox. An attacker triggers it by luring a user to load a crafted HTML page, and the flaw is exploited only after the attacker has already compromised the renderer process, making it a typical second-stage link in a browser exploit chain. Once outside the sandbox, the attacker can potentially execute arbitrary code with privileges beyond the sandbox on the user's system. All Chrome users running unpatched builds are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, the flaw is not yet in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Update Chrome to 153.0.8010.36 or later on all endpoints and verify the installed version via chrome://settings/help with automatic updates enabled. Because exploitation requires a prior renderer-process compromise, treat this patch as part of a chain-defense strategy alongside other Chromium renderer fixes and keep site isolation enabled. Monitor Google's release notes for any scope changes; no specific workarounds are documented.