Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-87520: Chrome Android before 153 may run malicious code
CVE-2026-87520 · published 1 month ago
Summary
Google Chrome on Android and the Chromium browser on Debian that are older than version 153 can be tricked by a specially crafted web page to run code outside the browser's safety sandbox. This could let a remote attacker take control of the device or system. Upgrade the browsers to the latest version to protect against this risk.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 153.0.8010.36 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seve...
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published9 Sep 2026
Updated14 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta