CVE-2026-87510

CVE-2026-87510 is an improper input validation flaw (CWE-20) in the FileAPI component of Google Chrome. It is triggered via a crafted HTML page and, per the CVSS vector, requires the attacker to have already compromised the Chrome renderer process before the flaw can be leveraged. A successful exploit lets the attacker execute arbitrary code outside the Chrome sandbox, escalating a renderer-level compromise to broader code execution with high confidentiality, integrity and availability impact. Users running Google Chrome prior to 153.0.8010.36 are affected. There is no known exploitation at this time: no public proof-of-concept, not listed in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3% (22nd percentile).

What to do: Update Google Chrome to 153.0.8010.36 or later on all endpoints, using enterprise update management to confirm fleet-wide patch levels. Note that this flaw is a sandbox escape requiring a separate renderer compromise, so also prioritize patching any renderer-execution vulnerabilities and caution users about opening untrusted HTML pages.