{"id":"CVE-2026-87558","title":"Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:26.300","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87558","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/553128689","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:30:20.314903Z"},"epss":0.00395,"epssPercentile":0.33505,"ingestedAt":"2026-09-09T01:17:17.511Z","slug":"CVE-2026-87558","body":"## Overview\n\nUse after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202426,"id":"CVE-2026-87558","ts":1789400073713,"field":"cvss","old":null,"new":"9.6"},{"seq":202425,"id":"CVE-2026-87558","ts":1789400073713,"field":"severity","old":"none","new":"critical"},{"seq":201153,"id":"CVE-2026-87558","ts":1789397620107,"field":"cvss","old":"9.6","new":null},{"seq":201152,"id":"CVE-2026-87558","ts":1789397620107,"field":"severity","old":"critical","new":"none"},{"seq":199846,"id":"CVE-2026-87558","ts":1789395578071,"field":"cvss","old":null,"new":"9.6"},{"seq":199845,"id":"CVE-2026-87558","ts":1789395578071,"field":"severity","old":"none","new":"critical"},{"seq":199087,"id":"CVE-2026-87558","ts":1789392260190,"field":"cvss","old":"9.6","new":null},{"seq":199086,"id":"CVE-2026-87558","ts":1789392260190,"field":"severity","old":"critical","new":"none"},{"seq":197420,"id":"CVE-2026-87558","ts":1789384296736,"field":"cvss","old":null,"new":"9.6"},{"seq":197419,"id":"CVE-2026-87558","ts":1789384296736,"field":"severity","old":"none","new":"critical"},{"seq":196694,"id":"CVE-2026-87558","ts":1789383770739,"field":"cvss","old":"9.6","new":null},{"seq":196693,"id":"CVE-2026-87558","ts":1789383770739,"field":"severity","old":"critical","new":"none"},{"seq":195598,"id":"CVE-2026-87558","ts":1789380578107,"field":"cvss","old":null,"new":"9.6"},{"seq":195597,"id":"CVE-2026-87558","ts":1789380578107,"field":"severity","old":"none","new":"critical"},{"seq":194549,"id":"CVE-2026-87558","ts":1789378789338,"field":"cvss","old":"9.6","new":null},{"seq":194548,"id":"CVE-2026-87558","ts":1789378789338,"field":"severity","old":"critical","new":"none"},{"seq":193336,"id":"CVE-2026-87558","ts":1789376520754,"field":"cvss","old":null,"new":"9.6"},{"seq":193335,"id":"CVE-2026-87558","ts":1789376520754,"field":"severity","old":"none","new":"critical"},{"seq":192123,"id":"CVE-2026-87558","ts":1789373639136,"field":"cvss","old":"9.6","new":null},{"seq":192122,"id":"CVE-2026-87558","ts":1789373639136,"field":"severity","old":"critical","new":"none"},{"seq":190908,"id":"CVE-2026-87558","ts":1789369487664,"field":"cvss","old":null,"new":"9.6"},{"seq":190907,"id":"CVE-2026-87558","ts":1789369487664,"field":"severity","old":"none","new":"critical"},{"seq":189695,"id":"CVE-2026-87558","ts":1789368460719,"field":"cvss","old":"9.6","new":null},{"seq":189694,"id":"CVE-2026-87558","ts":1789368460719,"field":"severity","old":"critical","new":"none"},{"seq":188478,"id":"CVE-2026-87558","ts":1789365236679,"field":"cvss","old":null,"new":"9.6"},{"seq":188477,"id":"CVE-2026-87558","ts":1789365236679,"field":"severity","old":"none","new":"critical"},{"seq":187265,"id":"CVE-2026-87558","ts":1789363480057,"field":"cvss","old":"9.6","new":null},{"seq":187264,"id":"CVE-2026-87558","ts":1789363480057,"field":"severity","old":"critical","new":"none"},{"seq":186051,"id":"CVE-2026-87558","ts":1789361235324,"field":"cvss","old":null,"new":"9.6"},{"seq":186050,"id":"CVE-2026-87558","ts":1789361235324,"field":"severity","old":"none","new":"critical"},{"seq":184838,"id":"CVE-2026-87558","ts":1789358377064,"field":"cvss","old":"9.6","new":null},{"seq":184837,"id":"CVE-2026-87558","ts":1789358377064,"field":"severity","old":"critical","new":"none"},{"seq":183087,"id":"CVE-2026-87558","ts":1789354323179,"field":"cvss","old":null,"new":"9.6"},{"seq":183086,"id":"CVE-2026-87558","ts":1789354323179,"field":"severity","old":"none","new":"critical"},{"seq":181880,"id":"CVE-2026-87558","ts":1789353335036,"field":"cvss","old":"9.6","new":null},{"seq":181879,"id":"CVE-2026-87558","ts":1789353335036,"field":"severity","old":"critical","new":"none"},{"seq":180673,"id":"CVE-2026-87558","ts":1789350290675,"field":"cvss","old":null,"new":"9.6"},{"seq":180672,"id":"CVE-2026-87558","ts":1789350290675,"field":"severity","old":"none","new":"critical"},{"seq":179466,"id":"CVE-2026-87558","ts":1789348308328,"field":"cvss","old":"9.6","new":null},{"seq":179465,"id":"CVE-2026-87558","ts":1789348308328,"field":"severity","old":"critical","new":"none"},{"seq":178259,"id":"CVE-2026-87558","ts":1789346377677,"field":"cvss","old":null,"new":"9.6"},{"seq":178258,"id":"CVE-2026-87558","ts":1789346377677,"field":"severity","old":"none","new":"critical"},{"seq":177052,"id":"CVE-2026-87558","ts":1789343188273,"field":"cvss","old":"9.6","new":null},{"seq":177051,"id":"CVE-2026-87558","ts":1789343188273,"field":"severity","old":"critical","new":"none"},{"seq":175169,"id":"CVE-2026-87558","ts":1789334884325,"field":"cvss","old":null,"new":"9.6"},{"seq":175168,"id":"CVE-2026-87558","ts":1789334884325,"field":"severity","old":"none","new":"critical"},{"seq":173964,"id":"CVE-2026-87558","ts":1789333703452,"field":"cvss","old":"9.6","new":null},{"seq":173963,"id":"CVE-2026-87558","ts":1789333703452,"field":"severity","old":"critical","new":"none"},{"seq":172778,"id":"CVE-2026-87558","ts":1789331096686,"field":"cvss","old":null,"new":"9.6"},{"seq":172777,"id":"CVE-2026-87558","ts":1789331096686,"field":"severity","old":"none","new":"critical"}]}