{"id":"CVE-2026-87637","title":"Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:30.550","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87637","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/534863145","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:29:49.303494Z"},"epss":0.00316,"epssPercentile":0.2473,"ingestedAt":"2026-09-09T01:17:17.507Z","slug":"CVE-2026-87637","body":"## Overview\n\nUse after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202585,"id":"CVE-2026-87637","ts":1789400086107,"field":"cvss","old":null,"new":"9.6"},{"seq":202584,"id":"CVE-2026-87637","ts":1789400086107,"field":"severity","old":"none","new":"critical"},{"seq":201312,"id":"CVE-2026-87637","ts":1789397620689,"field":"cvss","old":"9.6","new":null},{"seq":201311,"id":"CVE-2026-87637","ts":1789397620689,"field":"severity","old":"critical","new":"none"},{"seq":200005,"id":"CVE-2026-87637","ts":1789395578625,"field":"cvss","old":null,"new":"9.6"},{"seq":200004,"id":"CVE-2026-87637","ts":1789395578625,"field":"severity","old":"none","new":"critical"},{"seq":199242,"id":"CVE-2026-87637","ts":1789392260746,"field":"cvss","old":"9.6","new":null},{"seq":199241,"id":"CVE-2026-87637","ts":1789392260746,"field":"severity","old":"critical","new":"none"},{"seq":197575,"id":"CVE-2026-87637","ts":1789384297245,"field":"cvss","old":null,"new":"9.6"},{"seq":197574,"id":"CVE-2026-87637","ts":1789384297245,"field":"severity","old":"none","new":"critical"},{"seq":196849,"id":"CVE-2026-87637","ts":1789383781318,"field":"cvss","old":"9.6","new":null},{"seq":196848,"id":"CVE-2026-87637","ts":1789383781318,"field":"severity","old":"critical","new":"none"},{"seq":195753,"id":"CVE-2026-87637","ts":1789380578644,"field":"cvss","old":null,"new":"9.6"},{"seq":195752,"id":"CVE-2026-87637","ts":1789380578644,"field":"severity","old":"none","new":"critical"},{"seq":194704,"id":"CVE-2026-87637","ts":1789378789897,"field":"cvss","old":"9.6","new":null},{"seq":194703,"id":"CVE-2026-87637","ts":1789378789897,"field":"severity","old":"critical","new":"none"},{"seq":193491,"id":"CVE-2026-87637","ts":1789376521428,"field":"cvss","old":null,"new":"9.6"},{"seq":193490,"id":"CVE-2026-87637","ts":1789376521428,"field":"severity","old":"none","new":"critical"},{"seq":192278,"id":"CVE-2026-87637","ts":1789373639708,"field":"cvss","old":"9.6","new":null},{"seq":192277,"id":"CVE-2026-87637","ts":1789373639708,"field":"severity","old":"critical","new":"none"},{"seq":191063,"id":"CVE-2026-87637","ts":1789369489116,"field":"cvss","old":null,"new":"9.6"},{"seq":191062,"id":"CVE-2026-87637","ts":1789369489116,"field":"severity","old":"none","new":"critical"},{"seq":189850,"id":"CVE-2026-87637","ts":1789368461272,"field":"cvss","old":"9.6","new":null},{"seq":189849,"id":"CVE-2026-87637","ts":1789368461272,"field":"severity","old":"critical","new":"none"},{"seq":188633,"id":"CVE-2026-87637","ts":1789365237228,"field":"cvss","old":null,"new":"9.6"},{"seq":188632,"id":"CVE-2026-87637","ts":1789365237228,"field":"severity","old":"none","new":"critical"},{"seq":187420,"id":"CVE-2026-87637","ts":1789363480613,"field":"cvss","old":"9.6","new":null},{"seq":187419,"id":"CVE-2026-87637","ts":1789363480613,"field":"severity","old":"critical","new":"none"},{"seq":186206,"id":"CVE-2026-87637","ts":1789361235904,"field":"cvss","old":null,"new":"9.6"},{"seq":186205,"id":"CVE-2026-87637","ts":1789361235904,"field":"severity","old":"none","new":"critical"},{"seq":184993,"id":"CVE-2026-87637","ts":1789358383390,"field":"cvss","old":"9.6","new":null},{"seq":184992,"id":"CVE-2026-87637","ts":1789358383390,"field":"severity","old":"critical","new":"none"},{"seq":183242,"id":"CVE-2026-87637","ts":1789354323807,"field":"cvss","old":null,"new":"9.6"},{"seq":183241,"id":"CVE-2026-87637","ts":1789354323807,"field":"severity","old":"none","new":"critical"},{"seq":182035,"id":"CVE-2026-87637","ts":1789353335596,"field":"cvss","old":"9.6","new":null},{"seq":182034,"id":"CVE-2026-87637","ts":1789353335596,"field":"severity","old":"critical","new":"none"},{"seq":180828,"id":"CVE-2026-87637","ts":1789350291226,"field":"cvss","old":null,"new":"9.6"},{"seq":180827,"id":"CVE-2026-87637","ts":1789350291226,"field":"severity","old":"none","new":"critical"},{"seq":179621,"id":"CVE-2026-87637","ts":1789348308917,"field":"cvss","old":"9.6","new":null},{"seq":179620,"id":"CVE-2026-87637","ts":1789348308917,"field":"severity","old":"critical","new":"none"},{"seq":178414,"id":"CVE-2026-87637","ts":1789346378231,"field":"cvss","old":null,"new":"9.6"},{"seq":178413,"id":"CVE-2026-87637","ts":1789346378231,"field":"severity","old":"none","new":"critical"},{"seq":177207,"id":"CVE-2026-87637","ts":1789343188886,"field":"cvss","old":"9.6","new":null},{"seq":177206,"id":"CVE-2026-87637","ts":1789343188886,"field":"severity","old":"critical","new":"none"},{"seq":175324,"id":"CVE-2026-87637","ts":1789334884943,"field":"cvss","old":null,"new":"9.6"},{"seq":175323,"id":"CVE-2026-87637","ts":1789334884943,"field":"severity","old":"none","new":"critical"},{"seq":174119,"id":"CVE-2026-87637","ts":1789333704003,"field":"cvss","old":"9.6","new":null},{"seq":174118,"id":"CVE-2026-87637","ts":1789333704003,"field":"severity","old":"critical","new":"none"},{"seq":172933,"id":"CVE-2026-87637","ts":1789331097232,"field":"cvss","old":null,"new":"9.6"},{"seq":172932,"id":"CVE-2026-87637","ts":1789331097232,"field":"severity","old":"none","new":"critical"}]}