CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36
CVE-2026-87464 is a critical use-after-free in Chrome's WebGL allowing sandbox-escaping RCE via crafted HTML pages, fixed in 153.0.8010.36.
Google Chrome prior to 153.0.8010.36 contains a use-after-free in WebGL that allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Google rates it as Chromium security severity Critical, though tracker details are restricted. Debian indicates all current Chromium packages are affected, and the flaw likely impacts Chromium-derived browsers. No active exploitation is mentioned in the disclosure.
- Use-after-free in WebGL enables code execution outside the Chrome sandbox
- Exploitation requires luring users to a crafted HTML page
- No exploitation observed or claimed in the disclosure
- Debian indicates Chromium derivatives are also affected
- Fix is available in version 153.0.8010.36
- CVEs
- CVE-2026-87464
- Vendors
- Products
- Google ChromeChromium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87464 | Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox | 9.6 | <1% |
From the original article
Posted by Valtteri Vuorikoski on Sep 10 Use after free in WebGL in Google Chrome prior to 153. 0. 8010.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.