{"id":"CVE-2026-87613","title":"Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic","summary":"Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)","severity":"critical","cvss":9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-706"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:28.790","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87613","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/501889544","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T14:27:11.418110Z"},"epss":0.0035,"epssPercentile":0.28594,"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87613","body":"## Overview\n\nIncorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":49.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202537,"id":"CVE-2026-87613","ts":1789400085868,"field":"cvss","old":null,"new":"9"},{"seq":202536,"id":"CVE-2026-87613","ts":1789400085868,"field":"severity","old":"none","new":"critical"},{"seq":201264,"id":"CVE-2026-87613","ts":1789397620510,"field":"cvss","old":"9","new":null},{"seq":201263,"id":"CVE-2026-87613","ts":1789397620510,"field":"severity","old":"critical","new":"none"},{"seq":199957,"id":"CVE-2026-87613","ts":1789395578447,"field":"cvss","old":null,"new":"9"},{"seq":199956,"id":"CVE-2026-87613","ts":1789395578447,"field":"severity","old":"none","new":"critical"},{"seq":199196,"id":"CVE-2026-87613","ts":1789392260567,"field":"cvss","old":"9","new":null},{"seq":199195,"id":"CVE-2026-87613","ts":1789392260567,"field":"severity","old":"critical","new":"none"},{"seq":197529,"id":"CVE-2026-87613","ts":1789384297084,"field":"cvss","old":null,"new":"9"},{"seq":197528,"id":"CVE-2026-87613","ts":1789384297084,"field":"severity","old":"none","new":"critical"},{"seq":196803,"id":"CVE-2026-87613","ts":1789383777957,"field":"cvss","old":"9","new":null},{"seq":196802,"id":"CVE-2026-87613","ts":1789383777957,"field":"severity","old":"critical","new":"none"},{"seq":195707,"id":"CVE-2026-87613","ts":1789380578476,"field":"cvss","old":null,"new":"9"},{"seq":195706,"id":"CVE-2026-87613","ts":1789380578476,"field":"severity","old":"none","new":"critical"},{"seq":194658,"id":"CVE-2026-87613","ts":1789378789715,"field":"cvss","old":"9","new":null},{"seq":194657,"id":"CVE-2026-87613","ts":1789378789715,"field":"severity","old":"critical","new":"none"},{"seq":193445,"id":"CVE-2026-87613","ts":1789376521159,"field":"cvss","old":null,"new":"9"},{"seq":193444,"id":"CVE-2026-87613","ts":1789376521159,"field":"severity","old":"none","new":"critical"},{"seq":192232,"id":"CVE-2026-87613","ts":1789373639534,"field":"cvss","old":"9","new":null},{"seq":192231,"id":"CVE-2026-87613","ts":1789373639534,"field":"severity","old":"critical","new":"none"},{"seq":191017,"id":"CVE-2026-87613","ts":1789369488917,"field":"cvss","old":null,"new":"9"},{"seq":191016,"id":"CVE-2026-87613","ts":1789369488917,"field":"severity","old":"none","new":"critical"},{"seq":189804,"id":"CVE-2026-87613","ts":1789368461099,"field":"cvss","old":"9","new":null},{"seq":189803,"id":"CVE-2026-87613","ts":1789368461099,"field":"severity","old":"critical","new":"none"},{"seq":188587,"id":"CVE-2026-87613","ts":1789365237057,"field":"cvss","old":null,"new":"9"},{"seq":188586,"id":"CVE-2026-87613","ts":1789365237057,"field":"severity","old":"none","new":"critical"},{"seq":187374,"id":"CVE-2026-87613","ts":1789363480442,"field":"cvss","old":"9","new":null},{"seq":187373,"id":"CVE-2026-87613","ts":1789363480442,"field":"severity","old":"critical","new":"none"},{"seq":186160,"id":"CVE-2026-87613","ts":1789361235733,"field":"cvss","old":null,"new":"9"},{"seq":186159,"id":"CVE-2026-87613","ts":1789361235733,"field":"severity","old":"none","new":"critical"},{"seq":184947,"id":"CVE-2026-87613","ts":1789358379891,"field":"cvss","old":"9","new":null},{"seq":184946,"id":"CVE-2026-87613","ts":1789358379891,"field":"severity","old":"critical","new":"none"},{"seq":183196,"id":"CVE-2026-87613","ts":1789354323609,"field":"cvss","old":null,"new":"9"},{"seq":183195,"id":"CVE-2026-87613","ts":1789354323609,"field":"severity","old":"none","new":"critical"},{"seq":181989,"id":"CVE-2026-87613","ts":1789353335412,"field":"cvss","old":"9","new":null},{"seq":181988,"id":"CVE-2026-87613","ts":1789353335412,"field":"severity","old":"critical","new":"none"},{"seq":180782,"id":"CVE-2026-87613","ts":1789350291056,"field":"cvss","old":null,"new":"9"},{"seq":180781,"id":"CVE-2026-87613","ts":1789350291056,"field":"severity","old":"none","new":"critical"},{"seq":179575,"id":"CVE-2026-87613","ts":1789348308741,"field":"cvss","old":"9","new":null},{"seq":179574,"id":"CVE-2026-87613","ts":1789348308741,"field":"severity","old":"critical","new":"none"},{"seq":178368,"id":"CVE-2026-87613","ts":1789346378061,"field":"cvss","old":null,"new":"9"},{"seq":178367,"id":"CVE-2026-87613","ts":1789346378061,"field":"severity","old":"none","new":"critical"},{"seq":177161,"id":"CVE-2026-87613","ts":1789343188706,"field":"cvss","old":"9","new":null},{"seq":177160,"id":"CVE-2026-87613","ts":1789343188706,"field":"severity","old":"critical","new":"none"},{"seq":175278,"id":"CVE-2026-87613","ts":1789334884746,"field":"cvss","old":null,"new":"9"},{"seq":175277,"id":"CVE-2026-87613","ts":1789334884746,"field":"severity","old":"none","new":"critical"},{"seq":174073,"id":"CVE-2026-87613","ts":1789333703831,"field":"cvss","old":"9","new":null},{"seq":174072,"id":"CVE-2026-87613","ts":1789333703831,"field":"severity","old":"critical","new":"none"},{"seq":172887,"id":"CVE-2026-87613","ts":1789331097059,"field":"cvss","old":null,"new":"9"},{"seq":172886,"id":"CVE-2026-87613","ts":1789331097059,"field":"severity","old":"none","new":"critical"}]}