{"id":"CVE-2026-87588","title":"Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page","summary":"Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:27.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87588","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/495515356","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87588.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87588"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87588"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87588"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T12:47:23.837016Z"},"epss":0.00413,"epssPercentile":0.32818,"ingestedAt":"2026-09-09T01:17:17.511Z","slug":"CVE-2026-87588","body":"## Overview\n\nUse after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87588.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202487,"id":"CVE-2026-87588","ts":1789400079643,"field":"cvss","old":null,"new":"8.8"},{"seq":202486,"id":"CVE-2026-87588","ts":1789400079643,"field":"severity","old":"none","new":"high"},{"seq":201214,"id":"CVE-2026-87588","ts":1789397620332,"field":"cvss","old":"8.8","new":null},{"seq":201213,"id":"CVE-2026-87588","ts":1789397620332,"field":"severity","old":"high","new":"none"},{"seq":199907,"id":"CVE-2026-87588","ts":1789395578279,"field":"cvss","old":null,"new":"8.8"},{"seq":199906,"id":"CVE-2026-87588","ts":1789395578279,"field":"severity","old":"none","new":"high"},{"seq":199148,"id":"CVE-2026-87588","ts":1789392260397,"field":"cvss","old":"8.8","new":null},{"seq":199147,"id":"CVE-2026-87588","ts":1789392260397,"field":"severity","old":"high","new":"none"},{"seq":197481,"id":"CVE-2026-87588","ts":1789384296925,"field":"cvss","old":null,"new":"8.8"},{"seq":197480,"id":"CVE-2026-87588","ts":1789384296925,"field":"severity","old":"none","new":"high"},{"seq":196755,"id":"CVE-2026-87588","ts":1789383774674,"field":"cvss","old":"8.8","new":null},{"seq":196754,"id":"CVE-2026-87588","ts":1789383774674,"field":"severity","old":"high","new":"none"},{"seq":195659,"id":"CVE-2026-87588","ts":1789380578309,"field":"cvss","old":null,"new":"8.8"},{"seq":195658,"id":"CVE-2026-87588","ts":1789380578309,"field":"severity","old":"none","new":"high"},{"seq":194610,"id":"CVE-2026-87588","ts":1789378789545,"field":"cvss","old":"8.8","new":null},{"seq":194609,"id":"CVE-2026-87588","ts":1789378789545,"field":"severity","old":"high","new":"none"},{"seq":193397,"id":"CVE-2026-87588","ts":1789376520976,"field":"cvss","old":null,"new":"8.8"},{"seq":193396,"id":"CVE-2026-87588","ts":1789376520976,"field":"severity","old":"none","new":"high"},{"seq":192184,"id":"CVE-2026-87588","ts":1789373639354,"field":"cvss","old":"8.8","new":null},{"seq":192183,"id":"CVE-2026-87588","ts":1789373639354,"field":"severity","old":"high","new":"none"},{"seq":190969,"id":"CVE-2026-87588","ts":1789369487953,"field":"cvss","old":null,"new":"8.8"},{"seq":190968,"id":"CVE-2026-87588","ts":1789369487953,"field":"severity","old":"none","new":"high"},{"seq":189756,"id":"CVE-2026-87588","ts":1789368460925,"field":"cvss","old":"8.8","new":null},{"seq":189755,"id":"CVE-2026-87588","ts":1789368460925,"field":"severity","old":"high","new":"none"},{"seq":188539,"id":"CVE-2026-87588","ts":1789365236889,"field":"cvss","old":null,"new":"8.8"},{"seq":188538,"id":"CVE-2026-87588","ts":1789365236889,"field":"severity","old":"none","new":"high"},{"seq":187326,"id":"CVE-2026-87588","ts":1789363480262,"field":"cvss","old":"8.8","new":null},{"seq":187325,"id":"CVE-2026-87588","ts":1789363480262,"field":"severity","old":"high","new":"none"},{"seq":186112,"id":"CVE-2026-87588","ts":1789361235557,"field":"cvss","old":null,"new":"8.8"},{"seq":186111,"id":"CVE-2026-87588","ts":1789361235557,"field":"severity","old":"none","new":"high"},{"seq":184899,"id":"CVE-2026-87588","ts":1789358377299,"field":"cvss","old":"8.8","new":null},{"seq":184898,"id":"CVE-2026-87588","ts":1789358377299,"field":"severity","old":"high","new":"none"},{"seq":183148,"id":"CVE-2026-87588","ts":1789354323413,"field":"cvss","old":null,"new":"8.8"},{"seq":183147,"id":"CVE-2026-87588","ts":1789354323413,"field":"severity","old":"none","new":"high"},{"seq":181941,"id":"CVE-2026-87588","ts":1789353335240,"field":"cvss","old":"8.8","new":null},{"seq":181940,"id":"CVE-2026-87588","ts":1789353335240,"field":"severity","old":"high","new":"none"},{"seq":180734,"id":"CVE-2026-87588","ts":1789350290886,"field":"cvss","old":null,"new":"8.8"},{"seq":180733,"id":"CVE-2026-87588","ts":1789350290886,"field":"severity","old":"none","new":"high"},{"seq":179527,"id":"CVE-2026-87588","ts":1789348308562,"field":"cvss","old":"8.8","new":null},{"seq":179526,"id":"CVE-2026-87588","ts":1789348308562,"field":"severity","old":"high","new":"none"},{"seq":178320,"id":"CVE-2026-87588","ts":1789346377888,"field":"cvss","old":null,"new":"8.8"},{"seq":178319,"id":"CVE-2026-87588","ts":1789346377888,"field":"severity","old":"none","new":"high"},{"seq":177113,"id":"CVE-2026-87588","ts":1789343188515,"field":"cvss","old":"8.8","new":null},{"seq":177112,"id":"CVE-2026-87588","ts":1789343188515,"field":"severity","old":"high","new":"none"},{"seq":175230,"id":"CVE-2026-87588","ts":1789334884555,"field":"cvss","old":null,"new":"8.8"},{"seq":175229,"id":"CVE-2026-87588","ts":1789334884555,"field":"severity","old":"none","new":"high"},{"seq":174025,"id":"CVE-2026-87588","ts":1789333703660,"field":"cvss","old":"8.8","new":null},{"seq":174024,"id":"CVE-2026-87588","ts":1789333703660,"field":"severity","old":"high","new":"none"},{"seq":172839,"id":"CVE-2026-87588","ts":1789331096888,"field":"cvss","old":null,"new":"8.8"},{"seq":172838,"id":"CVE-2026-87588","ts":1789331096888,"field":"severity","old":"none","new":"high"}]}