CVE-2026-87636

CVE-2026-87636 is a type confusion flaw (CWE-843) in Google Chrome's XML handling, which can cause the browser to misinterpret data types while parsing XML content. An attacker triggers it by luring a user to a crafted HTML page containing malicious XML, with no privileges required but user interaction needed. If exploited, the attacker can potentially execute arbitrary code inside the Chrome sandbox, which limits the impact of any resulting code execution to the compromised renderer process rather than the host system. Users of Google Chrome on versions prior to 153.0.8010.36 are affected. There is currently no evidence of in-the-wild exploitation, no known public proof-of-concept, and a low EPSS score (0.3%), and Google rates the flaw as Medium severity in its own scale.

What to do: Update Google Chrome to version 153.0.8010.36 or later, which is available via Chrome's auto-update; users can verify their version at chrome://settings/help or chrome://version. Enterprise administrators should confirm via update management tooling that all managed endpoints have received the 153.0.8010.36 build. Because exploitation requires user interaction, remind users to avoid clicking links from untrusted sources until updates are confirmed.