GoogleCVE-2026-87578

Google Chrome: use after free

High8.3CVE-2026-87578 · Published Sep 9, 2026 · updated Sep 10, 2026

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

Google advisory

Affected versions

Package	Affected	Fixed in
Chrome Product	>= 153.0.8010.36, < 153.0.8010.36	153.0.8010.36

Details and references

CVSS 3.1: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-416

More Google advisories

All Google

Date	Advisory	Severity	Fixed in
Sep 9	Google cel-go: excessive memory allocation Medium6.9Sep 9 CVE-2026-835300.29.0	Medium6.9	0.29.0
Sep 9	Google Chrome: clickjacking Medium5.4Sep 9 CVE-2026-87655153.0.8010.36	Medium5.4	153.0.8010.36
Sep 9	Google Chrome: remote attacker could bypass system access restrictions Medium5.4Sep 9 CVE-2026-87656153.0.8010.36	Medium5.4	153.0.8010.36
Sep 9	Google Chrome: use after free Low3.1Sep 9 CVE-2026-87657153.0.8010.36	Low3.1	153.0.8010.36
Sep 9	Google Chrome: information disclosure Medium4.3Sep 9 CVE-2026-87658153.0.8010.36	Medium4.3	153.0.8010.36
Sep 9	Google Chrome: use after free Critical9.6Sep 9 CVE-2026-87646153.0.8010.36	Critical9.6	153.0.8010.36

Affected versions

More Google advisories

Critical advisories by email