CVE-2026-87618

CVE-2026-87618 is an incorrect reference resolution flaw (CWE-706) in the Storage component of Google Chrome on Windows. It is triggered when a remote attacker, who has already compromised the browser's renderer process, gets the user to load a crafted HTML page. Successful exploitation allows the attacker to potentially execute arbitrary code outside the Chrome sandbox, effectively a sandbox escape; Chromium rates the flaw Low severity precisely because it requires that pre-existing renderer compromise. Anyone running Google Chrome on Windows prior to version 153.0.8010.36 is affected. No public proof-of-concept or in-the-wild exploitation is currently known, the flaw is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at just 0.2%.

What to do: Update Google Chrome on Windows to 153.0.8010.36 or later; enterprises should verify patched browser versions via their update-management or endpoint inventories and keep managed-browser auto-update policies enabled. Treat this as a chain component: it matters most when combined with a renderer exploit, so patch promptly but prioritize higher-severity Chrome renderer bugs alongside it.