CVE-2026-87509

CVE-2026-87509 is an incorrect authorization flaw (CWE-863) in the updater component of Google Chrome on Windows. A local attacker, already able to run a program on the machine, can leverage the flaw to execute arbitrary code outside Chrome's sandbox. Successful exploitation defeats Chrome's sandbox isolation and yields arbitrary code execution with broader rights on the Windows host, though the local attack vector and high exploitation complexity keep practical risk low. Only Google Chrome on Windows prior to 153.0.8010.36 is affected per the advisory. No public proof-of-concept or in-the-wild exploitation is known; the issue is not in CISA KEV, EPSS assigns just a 0.2% 30-day exploitation probability, and Chromium rates the severity Low despite the High CVSS 8.1 score.

What to do: Update Google Chrome on Windows to 153.0.8010.36 or later, verifying the version via Chrome's About page or your enterprise update-management tooling. Because exploitation requires an existing local program, treat this as defense-in-depth: confirm the Chrome updater service is enabled and auto-updates are functioning. No workarounds or public PoC are known.