{"id":"CVE-2026-87636","title":"Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page","summary":"Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-843"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:30.377","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87636","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/495541478","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87636.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87636"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87636"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87636"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T12:54:22.866641Z"},"epss":0.00451,"epssPercentile":0.36535,"ingestedAt":"2026-09-09T01:17:17.511Z","slug":"CVE-2026-87636","body":"## Overview\n\nType confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87636.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202583,"id":"CVE-2026-87636","ts":1789400086099,"field":"cvss","old":null,"new":"8.8"},{"seq":202582,"id":"CVE-2026-87636","ts":1789400086099,"field":"severity","old":"none","new":"high"},{"seq":201310,"id":"CVE-2026-87636","ts":1789397620682,"field":"cvss","old":"8.8","new":null},{"seq":201309,"id":"CVE-2026-87636","ts":1789397620682,"field":"severity","old":"high","new":"none"},{"seq":200003,"id":"CVE-2026-87636","ts":1789395578618,"field":"cvss","old":null,"new":"8.8"},{"seq":200002,"id":"CVE-2026-87636","ts":1789395578618,"field":"severity","old":"none","new":"high"},{"seq":199240,"id":"CVE-2026-87636","ts":1789392260739,"field":"cvss","old":"8.8","new":null},{"seq":199239,"id":"CVE-2026-87636","ts":1789392260739,"field":"severity","old":"high","new":"none"},{"seq":197573,"id":"CVE-2026-87636","ts":1789384297239,"field":"cvss","old":null,"new":"8.8"},{"seq":197572,"id":"CVE-2026-87636","ts":1789384297239,"field":"severity","old":"none","new":"high"},{"seq":196847,"id":"CVE-2026-87636","ts":1789383781178,"field":"cvss","old":"8.8","new":null},{"seq":196846,"id":"CVE-2026-87636","ts":1789383781178,"field":"severity","old":"high","new":"none"},{"seq":195751,"id":"CVE-2026-87636","ts":1789380578638,"field":"cvss","old":null,"new":"8.8"},{"seq":195750,"id":"CVE-2026-87636","ts":1789380578638,"field":"severity","old":"none","new":"high"},{"seq":194702,"id":"CVE-2026-87636","ts":1789378789891,"field":"cvss","old":"8.8","new":null},{"seq":194701,"id":"CVE-2026-87636","ts":1789378789891,"field":"severity","old":"high","new":"none"},{"seq":193489,"id":"CVE-2026-87636","ts":1789376521414,"field":"cvss","old":null,"new":"8.8"},{"seq":193488,"id":"CVE-2026-87636","ts":1789376521414,"field":"severity","old":"none","new":"high"},{"seq":192276,"id":"CVE-2026-87636","ts":1789373639701,"field":"cvss","old":"8.8","new":null},{"seq":192275,"id":"CVE-2026-87636","ts":1789373639701,"field":"severity","old":"high","new":"none"},{"seq":191061,"id":"CVE-2026-87636","ts":1789369489108,"field":"cvss","old":null,"new":"8.8"},{"seq":191060,"id":"CVE-2026-87636","ts":1789369489108,"field":"severity","old":"none","new":"high"},{"seq":189848,"id":"CVE-2026-87636","ts":1789368461265,"field":"cvss","old":"8.8","new":null},{"seq":189847,"id":"CVE-2026-87636","ts":1789368461265,"field":"severity","old":"high","new":"none"},{"seq":188631,"id":"CVE-2026-87636","ts":1789365237221,"field":"cvss","old":null,"new":"8.8"},{"seq":188630,"id":"CVE-2026-87636","ts":1789365237221,"field":"severity","old":"none","new":"high"},{"seq":187418,"id":"CVE-2026-87636","ts":1789363480607,"field":"cvss","old":"8.8","new":null},{"seq":187417,"id":"CVE-2026-87636","ts":1789363480607,"field":"severity","old":"high","new":"none"},{"seq":186204,"id":"CVE-2026-87636","ts":1789361235897,"field":"cvss","old":null,"new":"8.8"},{"seq":186203,"id":"CVE-2026-87636","ts":1789361235897,"field":"severity","old":"none","new":"high"},{"seq":184991,"id":"CVE-2026-87636","ts":1789358383253,"field":"cvss","old":"8.8","new":null},{"seq":184990,"id":"CVE-2026-87636","ts":1789358383253,"field":"severity","old":"high","new":"none"},{"seq":183240,"id":"CVE-2026-87636","ts":1789354323800,"field":"cvss","old":null,"new":"8.8"},{"seq":183239,"id":"CVE-2026-87636","ts":1789354323800,"field":"severity","old":"none","new":"high"},{"seq":182033,"id":"CVE-2026-87636","ts":1789353335588,"field":"cvss","old":"8.8","new":null},{"seq":182032,"id":"CVE-2026-87636","ts":1789353335588,"field":"severity","old":"high","new":"none"},{"seq":180826,"id":"CVE-2026-87636","ts":1789350291219,"field":"cvss","old":null,"new":"8.8"},{"seq":180825,"id":"CVE-2026-87636","ts":1789350291219,"field":"severity","old":"none","new":"high"},{"seq":179619,"id":"CVE-2026-87636","ts":1789348308910,"field":"cvss","old":"8.8","new":null},{"seq":179618,"id":"CVE-2026-87636","ts":1789348308910,"field":"severity","old":"high","new":"none"},{"seq":178412,"id":"CVE-2026-87636","ts":1789346378224,"field":"cvss","old":null,"new":"8.8"},{"seq":178411,"id":"CVE-2026-87636","ts":1789346378224,"field":"severity","old":"none","new":"high"},{"seq":177205,"id":"CVE-2026-87636","ts":1789343188878,"field":"cvss","old":"8.8","new":null},{"seq":177204,"id":"CVE-2026-87636","ts":1789343188878,"field":"severity","old":"high","new":"none"},{"seq":175322,"id":"CVE-2026-87636","ts":1789334884935,"field":"cvss","old":null,"new":"8.8"},{"seq":175321,"id":"CVE-2026-87636","ts":1789334884935,"field":"severity","old":"none","new":"high"},{"seq":174117,"id":"CVE-2026-87636","ts":1789333703996,"field":"cvss","old":"8.8","new":null},{"seq":174116,"id":"CVE-2026-87636","ts":1789333703996,"field":"severity","old":"high","new":"none"},{"seq":172931,"id":"CVE-2026-87636","ts":1789331097225,"field":"cvss","old":null,"new":"8.8"},{"seq":172930,"id":"CVE-2026-87636","ts":1789331097225,"field":"severity","old":"none","new":"high"}]}