{"id":"CVE-2026-87638","title":"Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:30.720","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87638","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/540024134","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:29:35.306391Z"},"epss":0.00316,"epssPercentile":0.24729,"ingestedAt":"2026-09-09T01:17:17.507Z","slug":"CVE-2026-87638","body":"## Overview\n\nOut of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202587,"id":"CVE-2026-87638","ts":1789400086117,"field":"cvss","old":null,"new":"9.6"},{"seq":202586,"id":"CVE-2026-87638","ts":1789400086117,"field":"severity","old":"none","new":"critical"},{"seq":201314,"id":"CVE-2026-87638","ts":1789397620696,"field":"cvss","old":"9.6","new":null},{"seq":201313,"id":"CVE-2026-87638","ts":1789397620696,"field":"severity","old":"critical","new":"none"},{"seq":200007,"id":"CVE-2026-87638","ts":1789395578632,"field":"cvss","old":null,"new":"9.6"},{"seq":200006,"id":"CVE-2026-87638","ts":1789395578632,"field":"severity","old":"none","new":"critical"},{"seq":199244,"id":"CVE-2026-87638","ts":1789392260753,"field":"cvss","old":"9.6","new":null},{"seq":199243,"id":"CVE-2026-87638","ts":1789392260753,"field":"severity","old":"critical","new":"none"},{"seq":197577,"id":"CVE-2026-87638","ts":1789384297251,"field":"cvss","old":null,"new":"9.6"},{"seq":197576,"id":"CVE-2026-87638","ts":1789384297251,"field":"severity","old":"none","new":"critical"},{"seq":196851,"id":"CVE-2026-87638","ts":1789383781459,"field":"cvss","old":"9.6","new":null},{"seq":196850,"id":"CVE-2026-87638","ts":1789383781459,"field":"severity","old":"critical","new":"none"},{"seq":195755,"id":"CVE-2026-87638","ts":1789380578651,"field":"cvss","old":null,"new":"9.6"},{"seq":195754,"id":"CVE-2026-87638","ts":1789380578651,"field":"severity","old":"none","new":"critical"},{"seq":194706,"id":"CVE-2026-87638","ts":1789378789904,"field":"cvss","old":"9.6","new":null},{"seq":194705,"id":"CVE-2026-87638","ts":1789378789904,"field":"severity","old":"critical","new":"none"},{"seq":193493,"id":"CVE-2026-87638","ts":1789376521442,"field":"cvss","old":null,"new":"9.6"},{"seq":193492,"id":"CVE-2026-87638","ts":1789376521442,"field":"severity","old":"none","new":"critical"},{"seq":192280,"id":"CVE-2026-87638","ts":1789373639715,"field":"cvss","old":"9.6","new":null},{"seq":192279,"id":"CVE-2026-87638","ts":1789373639715,"field":"severity","old":"critical","new":"none"},{"seq":191065,"id":"CVE-2026-87638","ts":1789369489124,"field":"cvss","old":null,"new":"9.6"},{"seq":191064,"id":"CVE-2026-87638","ts":1789369489124,"field":"severity","old":"none","new":"critical"},{"seq":189852,"id":"CVE-2026-87638","ts":1789368461279,"field":"cvss","old":"9.6","new":null},{"seq":189851,"id":"CVE-2026-87638","ts":1789368461279,"field":"severity","old":"critical","new":"none"},{"seq":188635,"id":"CVE-2026-87638","ts":1789365237235,"field":"cvss","old":null,"new":"9.6"},{"seq":188634,"id":"CVE-2026-87638","ts":1789365237235,"field":"severity","old":"none","new":"critical"},{"seq":187422,"id":"CVE-2026-87638","ts":1789363480620,"field":"cvss","old":"9.6","new":null},{"seq":187421,"id":"CVE-2026-87638","ts":1789363480620,"field":"severity","old":"critical","new":"none"},{"seq":186208,"id":"CVE-2026-87638","ts":1789361235911,"field":"cvss","old":null,"new":"9.6"},{"seq":186207,"id":"CVE-2026-87638","ts":1789361235911,"field":"severity","old":"none","new":"critical"},{"seq":184995,"id":"CVE-2026-87638","ts":1789358383531,"field":"cvss","old":"9.6","new":null},{"seq":184994,"id":"CVE-2026-87638","ts":1789358383531,"field":"severity","old":"critical","new":"none"},{"seq":183244,"id":"CVE-2026-87638","ts":1789354323815,"field":"cvss","old":null,"new":"9.6"},{"seq":183243,"id":"CVE-2026-87638","ts":1789354323815,"field":"severity","old":"none","new":"critical"},{"seq":182037,"id":"CVE-2026-87638","ts":1789353335604,"field":"cvss","old":"9.6","new":null},{"seq":182036,"id":"CVE-2026-87638","ts":1789353335604,"field":"severity","old":"critical","new":"none"},{"seq":180830,"id":"CVE-2026-87638","ts":1789350291232,"field":"cvss","old":null,"new":"9.6"},{"seq":180829,"id":"CVE-2026-87638","ts":1789350291232,"field":"severity","old":"none","new":"critical"},{"seq":179623,"id":"CVE-2026-87638","ts":1789348308925,"field":"cvss","old":"9.6","new":null},{"seq":179622,"id":"CVE-2026-87638","ts":1789348308925,"field":"severity","old":"critical","new":"none"},{"seq":178416,"id":"CVE-2026-87638","ts":1789346378238,"field":"cvss","old":null,"new":"9.6"},{"seq":178415,"id":"CVE-2026-87638","ts":1789346378238,"field":"severity","old":"none","new":"critical"},{"seq":177209,"id":"CVE-2026-87638","ts":1789343188894,"field":"cvss","old":"9.6","new":null},{"seq":177208,"id":"CVE-2026-87638","ts":1789343188894,"field":"severity","old":"critical","new":"none"},{"seq":175326,"id":"CVE-2026-87638","ts":1789334884950,"field":"cvss","old":null,"new":"9.6"},{"seq":175325,"id":"CVE-2026-87638","ts":1789334884950,"field":"severity","old":"none","new":"critical"},{"seq":174121,"id":"CVE-2026-87638","ts":1789333704010,"field":"cvss","old":"9.6","new":null},{"seq":174120,"id":"CVE-2026-87638","ts":1789333704010,"field":"severity","old":"critical","new":"none"},{"seq":172935,"id":"CVE-2026-87638","ts":1789331097239,"field":"cvss","old":null,"new":"9.6"},{"seq":172934,"id":"CVE-2026-87638","ts":1789331097239,"field":"severity","old":"none","new":"critical"}]}