CVE-2026-87630

CVE-2026-87630 is an integer-overflow flaw (CWE-190) in the WebRTC component of Google Chrome, rated Medium (CVSS 3.1: 4.3) at Chromium security severity Medium, and it is fixed in Chrome 153.0.8010.36 — one of 230 security fixes in that release, per related coverage. A remote attacker triggers it by luring a user (user interaction is required) to open a crafted HTML page, causing the integer overflow in WebRTC processing. Successful exploitation lets the attacker read memory inside Chrome's sandbox — an information-disclosure condition (low confidentiality impact, no integrity or availability impact) that could leak in-sandbox data or serve as a link in a broader exploit chain. Anyone running Google Chrome on a version before 153.0.8010.36 is affected; the advisory names only Chrome, and given Chrome's install base the exposed population is on the order of billions of users. No public proof-of-concept is known and EPSS puts 30-day exploitation probability at just 0.2% (15th percentile); the Chrome 153 release was reported alongside an unspecified zero-day exploited in the wild, but the provided data does not confirm that this specific CVE is that zero-day.

What to do: Update Google Chrome to 153.0.8010.36 or later (check chrome://settings/help) and enforce the version through managed browser update policies, confirming no managed endpoints remain on older builds. Because exploitation requires a user to load a crafted page, treat unsolicited links cautiously until patched, and note that in-sandbox memory-disclosure bugs are commonly chained with sandbox-escape flaws, so prompt patching matters.