CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36

CVE-2026-87464 is a use-after-free (CWE-416) in the WebGL component of Google Chrome affecting versions prior to 153.0.8010.36. A remote attacker can trigger it by luring a user to open a crafted HTML page, which corrupts memory in the browser's WebGL rendering path. Successful exploitation allows arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's process isolation and runs code with the privileges of the browser on the host. All Chrome users running an unpatched version before 153.0.8010.36 are affected. As of now there is no public proof-of-concept and this specific flaw is not in CISA KEV, although the Chrome 153 release headlines reference a separate V8 zero-day that was exploited in the wild.

Do: Update Google Chrome to 153.0.8010.36 or later immediately; Chrome 153 ships 230 security fixes, so unpatched installs are exposed to this and numerous other flaws. Verify the patched version fleet-wide (Help > About Chrome confirms and triggers the update), prioritize endpoints and users who browse untrusted websites, and note that the separately exploited V8 zero-day is also fixed in this release, raising the urgency of patching.