CVE-2026-87527

CVE-2026-87527 is a buffer overflow (CWE-122) in the WebGL component of Google Chrome that is triggered when a user visits a crafted HTML page, requiring no authentication and no special privileges. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox, meaning the attacker breaks out of Chrome's core containment boundary — a high-impact outcome reflected in its Critical Chromium severity and 9.6 CVSS score. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days; the zero-day exploited in the wild cited in related headlines is a separate V8 issue also fixed in the Chrome 153 release. Defenders should nonetheless treat this as high priority given the severity, the attack's web-browsing trigger, and the sandbox-escape impact.

What to do: Update Chrome to 153.0.8010.36 or later and verify the installed version via chrome://settings/help or your managed browser update tooling; enterprise admins should audit fleet versions and force updates rather than waiting for auto-update. Until patched, limit untrusted web browsing on high-value endpoints. Note that the in-the-wild V8 zero-day mentioned in headlines is a separate flaw fixed in the same Chrome 153 release, so applying this update addresses both.