Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-87613: Chrome and Chromium can be tricked to run malicious code
CVE-2026-87613 · published 1 month ago
Summary
Google Chrome and the open-source Chromium browser versions before 153.0.8010.36 have a flaw in how they handle extensions. An attacker who sends specially crafted web traffic could cause the browser to run malicious programs outside its normal security limits, potentially affecting the whole computer. Apply the latest browser updates (or upgrade to version 153.0.8010.36 or newer) as soon as possible to fix the problem.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 153.0.8010.36 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic....
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-706Use of Incorrectly-Resolved Name or Reference
Timeline
Published9 Sep 2026
Updated14 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta