{"id":"CVE-2026-87634","title":"Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:30.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87634","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/349994197","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87634.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87634"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87634"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:29:21.482817Z"},"epss":0.00395,"epssPercentile":0.33567,"scores":{"nvd":9.6,"vendor":0,"adp":9.6},"ingestedAt":"2026-09-09T01:17:17.506Z","slug":"CVE-2026-87634","body":"## Overview\n\nUse after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87634.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202579,"id":"CVE-2026-87634","ts":1789400086080,"field":"cvss","old":null,"new":"9.6"},{"seq":202578,"id":"CVE-2026-87634","ts":1789400086080,"field":"severity","old":"none","new":"critical"},{"seq":201306,"id":"CVE-2026-87634","ts":1789397620666,"field":"cvss","old":"9.6","new":null},{"seq":201305,"id":"CVE-2026-87634","ts":1789397620666,"field":"severity","old":"critical","new":"none"},{"seq":199999,"id":"CVE-2026-87634","ts":1789395578604,"field":"cvss","old":null,"new":"9.6"},{"seq":199998,"id":"CVE-2026-87634","ts":1789395578604,"field":"severity","old":"none","new":"critical"},{"seq":199236,"id":"CVE-2026-87634","ts":1789392260724,"field":"cvss","old":"9.6","new":null},{"seq":199235,"id":"CVE-2026-87634","ts":1789392260724,"field":"severity","old":"critical","new":"none"},{"seq":197569,"id":"CVE-2026-87634","ts":1789384297225,"field":"cvss","old":null,"new":"9.6"},{"seq":197568,"id":"CVE-2026-87634","ts":1789384297225,"field":"severity","old":"none","new":"critical"},{"seq":196843,"id":"CVE-2026-87634","ts":1789383780899,"field":"cvss","old":"9.6","new":null},{"seq":196842,"id":"CVE-2026-87634","ts":1789383780899,"field":"severity","old":"critical","new":"none"},{"seq":195747,"id":"CVE-2026-87634","ts":1789380578624,"field":"cvss","old":null,"new":"9.6"},{"seq":195746,"id":"CVE-2026-87634","ts":1789380578624,"field":"severity","old":"none","new":"critical"},{"seq":194698,"id":"CVE-2026-87634","ts":1789378789877,"field":"cvss","old":"9.6","new":null},{"seq":194697,"id":"CVE-2026-87634","ts":1789378789877,"field":"severity","old":"critical","new":"none"},{"seq":193485,"id":"CVE-2026-87634","ts":1789376521385,"field":"cvss","old":null,"new":"9.6"},{"seq":193484,"id":"CVE-2026-87634","ts":1789376521385,"field":"severity","old":"none","new":"critical"},{"seq":192272,"id":"CVE-2026-87634","ts":1789373639687,"field":"cvss","old":"9.6","new":null},{"seq":192271,"id":"CVE-2026-87634","ts":1789373639687,"field":"severity","old":"critical","new":"none"},{"seq":191057,"id":"CVE-2026-87634","ts":1789369489092,"field":"cvss","old":null,"new":"9.6"},{"seq":191056,"id":"CVE-2026-87634","ts":1789369489092,"field":"severity","old":"none","new":"critical"},{"seq":189844,"id":"CVE-2026-87634","ts":1789368461252,"field":"cvss","old":"9.6","new":null},{"seq":189843,"id":"CVE-2026-87634","ts":1789368461252,"field":"severity","old":"critical","new":"none"},{"seq":188627,"id":"CVE-2026-87634","ts":1789365237208,"field":"cvss","old":null,"new":"9.6"},{"seq":188626,"id":"CVE-2026-87634","ts":1789365237208,"field":"severity","old":"none","new":"critical"},{"seq":187414,"id":"CVE-2026-87634","ts":1789363480593,"field":"cvss","old":"9.6","new":null},{"seq":187413,"id":"CVE-2026-87634","ts":1789363480593,"field":"severity","old":"critical","new":"none"},{"seq":186200,"id":"CVE-2026-87634","ts":1789361235884,"field":"cvss","old":null,"new":"9.6"},{"seq":186199,"id":"CVE-2026-87634","ts":1789361235884,"field":"severity","old":"none","new":"critical"},{"seq":184987,"id":"CVE-2026-87634","ts":1789358382976,"field":"cvss","old":"9.6","new":null},{"seq":184986,"id":"CVE-2026-87634","ts":1789358382976,"field":"severity","old":"critical","new":"none"},{"seq":183236,"id":"CVE-2026-87634","ts":1789354323784,"field":"cvss","old":null,"new":"9.6"},{"seq":183235,"id":"CVE-2026-87634","ts":1789354323784,"field":"severity","old":"none","new":"critical"},{"seq":182029,"id":"CVE-2026-87634","ts":1789353335572,"field":"cvss","old":"9.6","new":null},{"seq":182028,"id":"CVE-2026-87634","ts":1789353335572,"field":"severity","old":"critical","new":"none"},{"seq":180822,"id":"CVE-2026-87634","ts":1789350291205,"field":"cvss","old":null,"new":"9.6"},{"seq":180821,"id":"CVE-2026-87634","ts":1789350291205,"field":"severity","old":"none","new":"critical"},{"seq":179615,"id":"CVE-2026-87634","ts":1789348308896,"field":"cvss","old":"9.6","new":null},{"seq":179614,"id":"CVE-2026-87634","ts":1789348308896,"field":"severity","old":"critical","new":"none"},{"seq":178408,"id":"CVE-2026-87634","ts":1789346378211,"field":"cvss","old":null,"new":"9.6"},{"seq":178407,"id":"CVE-2026-87634","ts":1789346378211,"field":"severity","old":"none","new":"critical"},{"seq":177201,"id":"CVE-2026-87634","ts":1789343188863,"field":"cvss","old":"9.6","new":null},{"seq":177200,"id":"CVE-2026-87634","ts":1789343188863,"field":"severity","old":"critical","new":"none"},{"seq":175318,"id":"CVE-2026-87634","ts":1789334884919,"field":"cvss","old":null,"new":"9.6"},{"seq":175317,"id":"CVE-2026-87634","ts":1789334884919,"field":"severity","old":"none","new":"critical"},{"seq":174113,"id":"CVE-2026-87634","ts":1789333703982,"field":"cvss","old":"9.6","new":null},{"seq":174112,"id":"CVE-2026-87634","ts":1789333703982,"field":"severity","old":"critical","new":"none"},{"seq":172927,"id":"CVE-2026-87634","ts":1789331097212,"field":"cvss","old":null,"new":"9.6"},{"seq":172926,"id":"CVE-2026-87634","ts":1789331097212,"field":"severity","old":"none","new":"critical"}]}