CVE-2026-87616

CVE-2026-87616 is an improper initialization flaw (CWE-665) in the Views component of Google Chrome on Windows, fixed in Chrome 153.0.8010.36. To exploit it, an attacker must first compromise the Chrome renderer process, typically by getting a user to open a crafted HTML page, and then use social engineering to obtain additional user interaction. If successful, the attacker can execute arbitrary code outside the Chrome sandbox, effectively a sandbox escape that grants broader access to the host than a renderer compromise alone. Only Chrome on Windows prior to 153.0.8010.36 is affected by this advisory. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

What to do: Update Chrome on Windows to version 153.0.8010.36 or later via chrome://settings/help. Because exploitation requires an already-compromised renderer plus user interaction, standard patch cadence is defensible, but prioritize Windows endpoints whose users browse untrusted websites. No workarounds are documented beyond prompt patching.