CVE-2026-87572

CVE-2026-87572 is an injection flaw (CWE-74) in the DevTools component of Google Chrome that Google rates High (Chromium security severity) with a CVSS 3.1 score of 8.3. It is triggered when a user loads a crafted HTML page, but critically the attacker must first have compromised the Chrome renderer process, meaning this flaw acts as a sandbox escape rather than a standalone remote code execution bug. Once the conditions are met, the attacker can potentially execute arbitrary code outside the Chrome sandbox, gaining code execution on the underlying host with privileges beyond the browser's normal isolation. Anyone running Google Chrome on a version prior to 153.0.8010.36 is affected. There is currently no evidence of active exploitation: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Update Google Chrome to version 153.0.8010.36 or later, which can be confirmed via chrome://settings/help or by letting auto-update run. Because exploitation requires an already-compromised renderer, treat this as defense-in-depth: patch promptly to close the sandbox escape path that chains with other Chrome renderer bugs. No workarounds are specified in the data, so updating is the primary mitigation.