Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-87558: Chrome on Mac can run malicious code from web page
CVE-2026-87558 · published 1 month ago
Summary
Google Chrome (and Chromium on Debian) versions before 153.0.8010.36 on macOS have a flaw that lets a malicious website execute code on the computer, bypassing Chrome's security sandbox. This could let attackers take control of the system. Update Chrome/Chromium to the latest version to fix the issue.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 153.0.8010.36 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seve...
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published9 Sep 2026
Updated14 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta