CVE-2026-87438

Critical9.6 Published on Sep 9, 2026

Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS score9.6 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-787

Vendorsgoogle

Affected products

Vendors	Product	Versions
google	chrome	< 153.0.8010.36
google	android	-

Vulnerabilities

Chrome V8 Zero-Day Exploited in Active Attacks: Update to Version 153 Now

Google fixes actively exploited Chrome V8 zero-day CVE-2026-87491 plus 229 flaws. Update to Chrome 153.0.8010.36/37 and restart now.

Sep 9, 202611:58 6 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Chrome V8 Zero-Day Exploited in Active Attacks: Update to Version 153 Now