{"id":"CVE-2026-87650","title":"Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page","summary":"Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-125"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T04:18:31.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87650","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/534912743","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-09T13:30:45.398674Z"},"epss":0.00316,"epssPercentile":0.2473,"ingestedAt":"2026-09-09T01:17:17.512Z","slug":"CVE-2026-87650","body":"## Overview\n\nOut of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202611,"id":"CVE-2026-87650","ts":1789400086227,"field":"cvss","old":null,"new":"9.6"},{"seq":202610,"id":"CVE-2026-87650","ts":1789400086227,"field":"severity","old":"none","new":"critical"},{"seq":201338,"id":"CVE-2026-87650","ts":1789397620782,"field":"cvss","old":"9.6","new":null},{"seq":201337,"id":"CVE-2026-87650","ts":1789397620782,"field":"severity","old":"critical","new":"none"},{"seq":200031,"id":"CVE-2026-87650","ts":1789395578716,"field":"cvss","old":null,"new":"9.6"},{"seq":200030,"id":"CVE-2026-87650","ts":1789395578716,"field":"severity","old":"none","new":"critical"},{"seq":199268,"id":"CVE-2026-87650","ts":1789392260837,"field":"cvss","old":"9.6","new":null},{"seq":199267,"id":"CVE-2026-87650","ts":1789392260837,"field":"severity","old":"critical","new":"none"},{"seq":197601,"id":"CVE-2026-87650","ts":1789384297328,"field":"cvss","old":null,"new":"9.6"},{"seq":197600,"id":"CVE-2026-87650","ts":1789384297328,"field":"severity","old":"none","new":"critical"},{"seq":196875,"id":"CVE-2026-87650","ts":1789383783146,"field":"cvss","old":"9.6","new":null},{"seq":196874,"id":"CVE-2026-87650","ts":1789383783146,"field":"severity","old":"critical","new":"none"},{"seq":195779,"id":"CVE-2026-87650","ts":1789380578731,"field":"cvss","old":null,"new":"9.6"},{"seq":195778,"id":"CVE-2026-87650","ts":1789380578731,"field":"severity","old":"none","new":"critical"},{"seq":194730,"id":"CVE-2026-87650","ts":1789378789986,"field":"cvss","old":"9.6","new":null},{"seq":194729,"id":"CVE-2026-87650","ts":1789378789986,"field":"severity","old":"critical","new":"none"},{"seq":193517,"id":"CVE-2026-87650","ts":1789376521618,"field":"cvss","old":null,"new":"9.6"},{"seq":193516,"id":"CVE-2026-87650","ts":1789376521618,"field":"severity","old":"none","new":"critical"},{"seq":192304,"id":"CVE-2026-87650","ts":1789373639797,"field":"cvss","old":"9.6","new":null},{"seq":192303,"id":"CVE-2026-87650","ts":1789373639797,"field":"severity","old":"critical","new":"none"},{"seq":191089,"id":"CVE-2026-87650","ts":1789369489227,"field":"cvss","old":null,"new":"9.6"},{"seq":191088,"id":"CVE-2026-87650","ts":1789369489227,"field":"severity","old":"none","new":"critical"},{"seq":189876,"id":"CVE-2026-87650","ts":1789368461362,"field":"cvss","old":"9.6","new":null},{"seq":189875,"id":"CVE-2026-87650","ts":1789368461362,"field":"severity","old":"critical","new":"none"},{"seq":188659,"id":"CVE-2026-87650","ts":1789365237314,"field":"cvss","old":null,"new":"9.6"},{"seq":188658,"id":"CVE-2026-87650","ts":1789365237314,"field":"severity","old":"none","new":"critical"},{"seq":187446,"id":"CVE-2026-87650","ts":1789363480704,"field":"cvss","old":"9.6","new":null},{"seq":187445,"id":"CVE-2026-87650","ts":1789363480704,"field":"severity","old":"critical","new":"none"},{"seq":186232,"id":"CVE-2026-87650","ts":1789361235992,"field":"cvss","old":null,"new":"9.6"},{"seq":186231,"id":"CVE-2026-87650","ts":1789361235992,"field":"severity","old":"none","new":"critical"},{"seq":185019,"id":"CVE-2026-87650","ts":1789358385191,"field":"cvss","old":"9.6","new":null},{"seq":185018,"id":"CVE-2026-87650","ts":1789358385191,"field":"severity","old":"critical","new":"none"},{"seq":183268,"id":"CVE-2026-87650","ts":1789354323910,"field":"cvss","old":null,"new":"9.6"},{"seq":183267,"id":"CVE-2026-87650","ts":1789354323910,"field":"severity","old":"none","new":"critical"},{"seq":182061,"id":"CVE-2026-87650","ts":1789353335689,"field":"cvss","old":"9.6","new":null},{"seq":182060,"id":"CVE-2026-87650","ts":1789353335689,"field":"severity","old":"critical","new":"none"},{"seq":180854,"id":"CVE-2026-87650","ts":1789350291314,"field":"cvss","old":null,"new":"9.6"},{"seq":180853,"id":"CVE-2026-87650","ts":1789350291314,"field":"severity","old":"none","new":"critical"},{"seq":179647,"id":"CVE-2026-87650","ts":1789348309016,"field":"cvss","old":"9.6","new":null},{"seq":179646,"id":"CVE-2026-87650","ts":1789348309016,"field":"severity","old":"critical","new":"none"},{"seq":178440,"id":"CVE-2026-87650","ts":1789346378319,"field":"cvss","old":null,"new":"9.6"},{"seq":178439,"id":"CVE-2026-87650","ts":1789346378319,"field":"severity","old":"none","new":"critical"},{"seq":177233,"id":"CVE-2026-87650","ts":1789343188978,"field":"cvss","old":"9.6","new":null},{"seq":177232,"id":"CVE-2026-87650","ts":1789343188978,"field":"severity","old":"critical","new":"none"},{"seq":175350,"id":"CVE-2026-87650","ts":1789334885045,"field":"cvss","old":null,"new":"9.6"},{"seq":175349,"id":"CVE-2026-87650","ts":1789334885045,"field":"severity","old":"none","new":"critical"},{"seq":174145,"id":"CVE-2026-87650","ts":1789333704100,"field":"cvss","old":"9.6","new":null},{"seq":174144,"id":"CVE-2026-87650","ts":1789333704100,"field":"severity","old":"critical","new":"none"},{"seq":172959,"id":"CVE-2026-87650","ts":1789331097320,"field":"cvss","old":null,"new":"9.6"},{"seq":172958,"id":"CVE-2026-87650","ts":1789331097320,"field":"severity","old":"none","new":"critical"}]}