{"id":"CVE-2026-87621","title":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:29.513","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87621","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/536664909","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87621.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87621"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530333"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87621"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87621"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:30:36.916399Z"},"epss":0.00462,"epssPercentile":0.37374,"ingestedAt":"2026-09-09T01:17:17.512Z","slug":"CVE-2026-87621","body":"## Overview\n\nOut of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Critical · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87621.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202553,"id":"CVE-2026-87621","ts":1789400085945,"field":"cvss","old":null,"new":"9.6"},{"seq":202552,"id":"CVE-2026-87621","ts":1789400085945,"field":"severity","old":"none","new":"critical"},{"seq":201280,"id":"CVE-2026-87621","ts":1789397620566,"field":"cvss","old":"9.6","new":null},{"seq":201279,"id":"CVE-2026-87621","ts":1789397620566,"field":"severity","old":"critical","new":"none"},{"seq":199973,"id":"CVE-2026-87621","ts":1789395578505,"field":"cvss","old":null,"new":"9.6"},{"seq":199972,"id":"CVE-2026-87621","ts":1789395578505,"field":"severity","old":"none","new":"critical"},{"seq":199212,"id":"CVE-2026-87621","ts":1789392260622,"field":"cvss","old":"9.6","new":null},{"seq":199211,"id":"CVE-2026-87621","ts":1789392260622,"field":"severity","old":"critical","new":"none"},{"seq":197545,"id":"CVE-2026-87621","ts":1789384297134,"field":"cvss","old":null,"new":"9.6"},{"seq":197544,"id":"CVE-2026-87621","ts":1789384297134,"field":"severity","old":"none","new":"critical"},{"seq":196819,"id":"CVE-2026-87621","ts":1789383779000,"field":"cvss","old":"9.6","new":null},{"seq":196818,"id":"CVE-2026-87621","ts":1789383779000,"field":"severity","old":"critical","new":"none"},{"seq":195723,"id":"CVE-2026-87621","ts":1789380578530,"field":"cvss","old":null,"new":"9.6"},{"seq":195722,"id":"CVE-2026-87621","ts":1789380578530,"field":"severity","old":"none","new":"critical"},{"seq":194674,"id":"CVE-2026-87621","ts":1789378789776,"field":"cvss","old":"9.6","new":null},{"seq":194673,"id":"CVE-2026-87621","ts":1789378789776,"field":"severity","old":"critical","new":"none"},{"seq":193461,"id":"CVE-2026-87621","ts":1789376521215,"field":"cvss","old":null,"new":"9.6"},{"seq":193460,"id":"CVE-2026-87621","ts":1789376521215,"field":"severity","old":"none","new":"critical"},{"seq":192248,"id":"CVE-2026-87621","ts":1789373639589,"field":"cvss","old":"9.6","new":null},{"seq":192247,"id":"CVE-2026-87621","ts":1789373639589,"field":"severity","old":"critical","new":"none"},{"seq":191033,"id":"CVE-2026-87621","ts":1789369488981,"field":"cvss","old":null,"new":"9.6"},{"seq":191032,"id":"CVE-2026-87621","ts":1789369488981,"field":"severity","old":"none","new":"critical"},{"seq":189820,"id":"CVE-2026-87621","ts":1789368461154,"field":"cvss","old":"9.6","new":null},{"seq":189819,"id":"CVE-2026-87621","ts":1789368461154,"field":"severity","old":"critical","new":"none"},{"seq":188603,"id":"CVE-2026-87621","ts":1789365237111,"field":"cvss","old":null,"new":"9.6"},{"seq":188602,"id":"CVE-2026-87621","ts":1789365237111,"field":"severity","old":"none","new":"critical"},{"seq":187390,"id":"CVE-2026-87621","ts":1789363480498,"field":"cvss","old":"9.6","new":null},{"seq":187389,"id":"CVE-2026-87621","ts":1789363480498,"field":"severity","old":"critical","new":"none"},{"seq":186176,"id":"CVE-2026-87621","ts":1789361235788,"field":"cvss","old":null,"new":"9.6"},{"seq":186175,"id":"CVE-2026-87621","ts":1789361235788,"field":"severity","old":"none","new":"critical"},{"seq":184963,"id":"CVE-2026-87621","ts":1789358381009,"field":"cvss","old":"9.6","new":null},{"seq":184962,"id":"CVE-2026-87621","ts":1789358381009,"field":"severity","old":"critical","new":"none"},{"seq":183212,"id":"CVE-2026-87621","ts":1789354323672,"field":"cvss","old":null,"new":"9.6"},{"seq":183211,"id":"CVE-2026-87621","ts":1789354323672,"field":"severity","old":"none","new":"critical"},{"seq":182005,"id":"CVE-2026-87621","ts":1789353335467,"field":"cvss","old":"9.6","new":null},{"seq":182004,"id":"CVE-2026-87621","ts":1789353335467,"field":"severity","old":"critical","new":"none"},{"seq":180798,"id":"CVE-2026-87621","ts":1789350291109,"field":"cvss","old":null,"new":"9.6"},{"seq":180797,"id":"CVE-2026-87621","ts":1789350291109,"field":"severity","old":"none","new":"critical"},{"seq":179591,"id":"CVE-2026-87621","ts":1789348308797,"field":"cvss","old":"9.6","new":null},{"seq":179590,"id":"CVE-2026-87621","ts":1789348308797,"field":"severity","old":"critical","new":"none"},{"seq":178384,"id":"CVE-2026-87621","ts":1789346378115,"field":"cvss","old":null,"new":"9.6"},{"seq":178383,"id":"CVE-2026-87621","ts":1789346378115,"field":"severity","old":"none","new":"critical"},{"seq":177177,"id":"CVE-2026-87621","ts":1789343188764,"field":"cvss","old":"9.6","new":null},{"seq":177176,"id":"CVE-2026-87621","ts":1789343188764,"field":"severity","old":"critical","new":"none"},{"seq":175294,"id":"CVE-2026-87621","ts":1789334884809,"field":"cvss","old":null,"new":"9.6"},{"seq":175293,"id":"CVE-2026-87621","ts":1789334884809,"field":"severity","old":"none","new":"critical"},{"seq":174089,"id":"CVE-2026-87621","ts":1789333703885,"field":"cvss","old":"9.6","new":null},{"seq":174088,"id":"CVE-2026-87621","ts":1789333703885,"field":"severity","old":"critical","new":"none"},{"seq":172903,"id":"CVE-2026-87621","ts":1789331097116,"field":"cvss","old":null,"new":"9.6"},{"seq":172902,"id":"CVE-2026-87621","ts":1789331097116,"field":"severity","old":"none","new":"critical"}]}