Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-87504: Chrome extensions may run code on your PC
CVE-2026-87504 · published 1 month ago
Summary
Versions of Google Chrome and Chromium older than 153.0.8010.36 let a specially crafted extension break out of the browser's safety barrier and run any program on the computer. This could let an attacker take control of the system after tricking a user into installing the extension. Update Chrome/Chromium to the latest version to close the gap and avoid installing untrusted extensions.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 153.0.8010.36 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. ...
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published9 Sep 2026
Updated14 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta