ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-87527

mass

Heap Buffer Overflow in Google Chrome WebGL Enables RCE Outside the Sandbox

CVSS 3.1
9.6 critical
EPSS
<1%p40
Published
()
Modified
AI analysis

CVE-2026-87527 is a buffer overflow (CWE-122) in the WebGL component of Google Chrome that is triggered when a user visits a crafted HTML page, requiring no authentication and no special privileges. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox, meaning the attacker breaks out of Chrome's core containment boundary — a high-impact outcome reflected in its Critical Chromium severity and 9.6 CVSS score. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days; the zero-day exploited in the wild cited in related headlines is a separate V8 issue also fixed in the Chrome 153 release. Defenders should nonetheless treat this as high priority given the severity, the attack's web-browsing trigger, and the sandbox-escape impact.

What to do: Update Chrome to 153.0.8010.36 or later and verify the installed version via chrome://settings/help or your managed browser update tooling; enterprise admins should audit fleet versions and force updates rather than waiting for auto-update. Until patched, limit untrusted web browsing on high-value endpoints. Note that the in-the-wild V8 zero-day mentioned in headlines is a separate flaw fixed in the same Chrome 153 release, so applying this update addresses both.

Affected
Google ChromeAll versions prior to 153.0.8010.36
Estimated exposure
mass≈3+ billion users (Chrome holds roughly 65% of desktop browser usage) — Estimate is based on Chrome's dominant desktop browser market share, with only users on builds older than 153.0.8010.36 remaining vulnerable after the 153 rollout completes.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Vendors
google
Products
chrome
Weakness
CWE-122
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.

Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.

The Hacker News · 6d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-2441CVE-2026-3909+10 CVEs

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.

GBHackers · 6d agoExploit / PoC in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+19 CVEs

Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild

Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.

Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.

Cyber Security News · 6d agoVulnerability in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+7 CVEs1