{"id":"CVE-2026-87554","title":"Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program","summary":"Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-367"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:26.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87554","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/524423633","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87554.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87554"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87554"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T14:22:35.846933Z"},"epss":0.001,"epssPercentile":0.00808,"scores":{"nvd":8.1,"vendor":8.8,"adp":8.1},"ingestedAt":"2026-09-09T01:17:17.512Z","slug":"CVE-2026-87554","body":"## Overview\n\nRace condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87554.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202418,"id":"CVE-2026-87554","ts":1789400072979,"field":"cvss","old":null,"new":"8.1"},{"seq":202417,"id":"CVE-2026-87554","ts":1789400072979,"field":"severity","old":"none","new":"high"},{"seq":201145,"id":"CVE-2026-87554","ts":1789397620074,"field":"cvss","old":"8.1","new":null},{"seq":201144,"id":"CVE-2026-87554","ts":1789397620074,"field":"severity","old":"high","new":"none"},{"seq":199838,"id":"CVE-2026-87554","ts":1789395578043,"field":"cvss","old":null,"new":"8.1"},{"seq":199837,"id":"CVE-2026-87554","ts":1789395578043,"field":"severity","old":"none","new":"high"},{"seq":199079,"id":"CVE-2026-87554","ts":1789392260164,"field":"cvss","old":"8.1","new":null},{"seq":199078,"id":"CVE-2026-87554","ts":1789392260164,"field":"severity","old":"high","new":"none"},{"seq":197412,"id":"CVE-2026-87554","ts":1789384296702,"field":"cvss","old":null,"new":"8.1"},{"seq":197411,"id":"CVE-2026-87554","ts":1789384296702,"field":"severity","old":"none","new":"high"},{"seq":196686,"id":"CVE-2026-87554","ts":1789383770214,"field":"cvss","old":"8.1","new":null},{"seq":196685,"id":"CVE-2026-87554","ts":1789383770214,"field":"severity","old":"high","new":"none"},{"seq":195590,"id":"CVE-2026-87554","ts":1789380578080,"field":"cvss","old":null,"new":"8.1"},{"seq":195589,"id":"CVE-2026-87554","ts":1789380578080,"field":"severity","old":"none","new":"high"},{"seq":194541,"id":"CVE-2026-87554","ts":1789378789311,"field":"cvss","old":"8.1","new":null},{"seq":194540,"id":"CVE-2026-87554","ts":1789378789311,"field":"severity","old":"high","new":"none"},{"seq":193328,"id":"CVE-2026-87554","ts":1789376520725,"field":"cvss","old":null,"new":"8.1"},{"seq":193327,"id":"CVE-2026-87554","ts":1789376520725,"field":"severity","old":"none","new":"high"},{"seq":192115,"id":"CVE-2026-87554","ts":1789373639104,"field":"cvss","old":"8.1","new":null},{"seq":192114,"id":"CVE-2026-87554","ts":1789373639104,"field":"severity","old":"high","new":"none"},{"seq":190900,"id":"CVE-2026-87554","ts":1789369487630,"field":"cvss","old":null,"new":"8.1"},{"seq":190899,"id":"CVE-2026-87554","ts":1789369487630,"field":"severity","old":"none","new":"high"},{"seq":189687,"id":"CVE-2026-87554","ts":1789368460691,"field":"cvss","old":"8.1","new":null},{"seq":189686,"id":"CVE-2026-87554","ts":1789368460691,"field":"severity","old":"high","new":"none"},{"seq":188470,"id":"CVE-2026-87554","ts":1789365236647,"field":"cvss","old":null,"new":"8.1"},{"seq":188469,"id":"CVE-2026-87554","ts":1789365236647,"field":"severity","old":"none","new":"high"},{"seq":187257,"id":"CVE-2026-87554","ts":1789363480029,"field":"cvss","old":"8.1","new":null},{"seq":187256,"id":"CVE-2026-87554","ts":1789363480029,"field":"severity","old":"high","new":"none"},{"seq":186043,"id":"CVE-2026-87554","ts":1789361235290,"field":"cvss","old":null,"new":"8.1"},{"seq":186042,"id":"CVE-2026-87554","ts":1789361235290,"field":"severity","old":"none","new":"high"},{"seq":184830,"id":"CVE-2026-87554","ts":1789358377026,"field":"cvss","old":"8.1","new":null},{"seq":184829,"id":"CVE-2026-87554","ts":1789358377026,"field":"severity","old":"high","new":"none"},{"seq":183079,"id":"CVE-2026-87554","ts":1789354323146,"field":"cvss","old":null,"new":"8.1"},{"seq":183078,"id":"CVE-2026-87554","ts":1789354323146,"field":"severity","old":"none","new":"high"},{"seq":181872,"id":"CVE-2026-87554","ts":1789353335008,"field":"cvss","old":"8.1","new":null},{"seq":181871,"id":"CVE-2026-87554","ts":1789353335008,"field":"severity","old":"high","new":"none"},{"seq":180665,"id":"CVE-2026-87554","ts":1789350290645,"field":"cvss","old":null,"new":"8.1"},{"seq":180664,"id":"CVE-2026-87554","ts":1789350290645,"field":"severity","old":"none","new":"high"},{"seq":179458,"id":"CVE-2026-87554","ts":1789348308296,"field":"cvss","old":"8.1","new":null},{"seq":179457,"id":"CVE-2026-87554","ts":1789348308296,"field":"severity","old":"high","new":"none"},{"seq":178251,"id":"CVE-2026-87554","ts":1789346377650,"field":"cvss","old":null,"new":"8.1"},{"seq":178250,"id":"CVE-2026-87554","ts":1789346377650,"field":"severity","old":"none","new":"high"},{"seq":177044,"id":"CVE-2026-87554","ts":1789343188245,"field":"cvss","old":"8.1","new":null},{"seq":177043,"id":"CVE-2026-87554","ts":1789343188245,"field":"severity","old":"high","new":"none"},{"seq":175161,"id":"CVE-2026-87554","ts":1789334884295,"field":"cvss","old":null,"new":"8.1"},{"seq":175160,"id":"CVE-2026-87554","ts":1789334884295,"field":"severity","old":"none","new":"high"},{"seq":173956,"id":"CVE-2026-87554","ts":1789333703423,"field":"cvss","old":"8.1","new":null},{"seq":173955,"id":"CVE-2026-87554","ts":1789333703423,"field":"severity","old":"high","new":"none"},{"seq":172770,"id":"CVE-2026-87554","ts":1789331096658,"field":"cvss","old":null,"new":"8.1"},{"seq":172769,"id":"CVE-2026-87554","ts":1789331096658,"field":"severity","old":"none","new":"high"}]}