{"id":"CVE-2026-87497","title":"Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page","summary":"Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-908"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:21:15.023","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87497","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/504670493","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87497.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87497"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87497"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87497"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00204,"epssPercentile":0.10727,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T20:02:15.382657Z"},"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87497","body":"## Overview\n\nUninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87497.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202304,"id":"CVE-2026-87497","ts":1789400065415,"field":"cvss","old":null,"new":"4.3"},{"seq":202303,"id":"CVE-2026-87497","ts":1789400065415,"field":"severity","old":"none","new":"medium"},{"seq":201031,"id":"CVE-2026-87497","ts":1789397619305,"field":"cvss","old":"4.3","new":null},{"seq":201030,"id":"CVE-2026-87497","ts":1789397619305,"field":"severity","old":"medium","new":"none"},{"seq":199724,"id":"CVE-2026-87497","ts":1789395570261,"field":"cvss","old":null,"new":"4.3"},{"seq":199723,"id":"CVE-2026-87497","ts":1789395570261,"field":"severity","old":"none","new":"medium"},{"seq":198965,"id":"CVE-2026-87497","ts":1789392258334,"field":"cvss","old":"4.3","new":null},{"seq":198964,"id":"CVE-2026-87497","ts":1789392258334,"field":"severity","old":"medium","new":"none"},{"seq":197298,"id":"CVE-2026-87497","ts":1789384296323,"field":"cvss","old":null,"new":"4.3"},{"seq":197297,"id":"CVE-2026-87497","ts":1789384296323,"field":"severity","old":"none","new":"medium"},{"seq":196572,"id":"CVE-2026-87497","ts":1789383762588,"field":"cvss","old":"4.3","new":null},{"seq":196571,"id":"CVE-2026-87497","ts":1789383762588,"field":"severity","old":"medium","new":"none"},{"seq":195476,"id":"CVE-2026-87497","ts":1789380577175,"field":"cvss","old":null,"new":"4.3"},{"seq":195475,"id":"CVE-2026-87497","ts":1789380577175,"field":"severity","old":"none","new":"medium"},{"seq":194427,"id":"CVE-2026-87497","ts":1789378786027,"field":"cvss","old":"4.3","new":null},{"seq":194426,"id":"CVE-2026-87497","ts":1789378786027,"field":"severity","old":"medium","new":"none"},{"seq":193214,"id":"CVE-2026-87497","ts":1789376520299,"field":"cvss","old":null,"new":"4.3"},{"seq":193213,"id":"CVE-2026-87497","ts":1789376520299,"field":"severity","old":"none","new":"medium"},{"seq":192001,"id":"CVE-2026-87497","ts":1789373636838,"field":"cvss","old":"4.3","new":null},{"seq":192000,"id":"CVE-2026-87497","ts":1789373636838,"field":"severity","old":"medium","new":"none"},{"seq":190786,"id":"CVE-2026-87497","ts":1789369487128,"field":"cvss","old":null,"new":"4.3"},{"seq":190785,"id":"CVE-2026-87497","ts":1789369487128,"field":"severity","old":"none","new":"medium"},{"seq":189573,"id":"CVE-2026-87497","ts":1789368458771,"field":"cvss","old":"4.3","new":null},{"seq":189572,"id":"CVE-2026-87497","ts":1789368458771,"field":"severity","old":"medium","new":"none"},{"seq":188356,"id":"CVE-2026-87497","ts":1789365236256,"field":"cvss","old":null,"new":"4.3"},{"seq":188355,"id":"CVE-2026-87497","ts":1789365236256,"field":"severity","old":"none","new":"medium"},{"seq":187143,"id":"CVE-2026-87497","ts":1789363478251,"field":"cvss","old":"4.3","new":null},{"seq":187142,"id":"CVE-2026-87497","ts":1789363478251,"field":"severity","old":"medium","new":"none"},{"seq":185929,"id":"CVE-2026-87497","ts":1789361234880,"field":"cvss","old":null,"new":"4.3"},{"seq":185928,"id":"CVE-2026-87497","ts":1789361234880,"field":"severity","old":"none","new":"medium"},{"seq":184716,"id":"CVE-2026-87497","ts":1789358375097,"field":"cvss","old":"4.3","new":null},{"seq":184715,"id":"CVE-2026-87497","ts":1789358375097,"field":"severity","old":"medium","new":"none"},{"seq":182965,"id":"CVE-2026-87497","ts":1789354322689,"field":"cvss","old":null,"new":"4.3"},{"seq":182964,"id":"CVE-2026-87497","ts":1789354322689,"field":"severity","old":"none","new":"medium"},{"seq":181758,"id":"CVE-2026-87497","ts":1789353332896,"field":"cvss","old":"4.3","new":null},{"seq":181757,"id":"CVE-2026-87497","ts":1789353332896,"field":"severity","old":"medium","new":"none"},{"seq":180551,"id":"CVE-2026-87497","ts":1789350290219,"field":"cvss","old":null,"new":"4.3"},{"seq":180550,"id":"CVE-2026-87497","ts":1789350290219,"field":"severity","old":"none","new":"medium"},{"seq":179344,"id":"CVE-2026-87497","ts":1789348305710,"field":"cvss","old":"4.3","new":null},{"seq":179343,"id":"CVE-2026-87497","ts":1789348305710,"field":"severity","old":"medium","new":"none"},{"seq":178137,"id":"CVE-2026-87497","ts":1789346377262,"field":"cvss","old":null,"new":"4.3"},{"seq":178136,"id":"CVE-2026-87497","ts":1789346377262,"field":"severity","old":"none","new":"medium"},{"seq":176930,"id":"CVE-2026-87497","ts":1789343187333,"field":"cvss","old":"4.3","new":null},{"seq":176929,"id":"CVE-2026-87497","ts":1789343187333,"field":"severity","old":"medium","new":"none"},{"seq":175047,"id":"CVE-2026-87497","ts":1789334883841,"field":"cvss","old":null,"new":"4.3"},{"seq":175046,"id":"CVE-2026-87497","ts":1789334883841,"field":"severity","old":"none","new":"medium"},{"seq":173842,"id":"CVE-2026-87497","ts":1789333703016,"field":"cvss","old":"4.3","new":null},{"seq":173841,"id":"CVE-2026-87497","ts":1789333703016,"field":"severity","old":"medium","new":"none"},{"seq":172656,"id":"CVE-2026-87497","ts":1789331096248,"field":"cvss","old":null,"new":"4.3"},{"seq":172655,"id":"CVE-2026-87497","ts":1789331096248,"field":"severity","old":"none","new":"medium"}]}