Executive brief
Google Chrome contains a memory safety flaw in its Media handling component that allows an attacker to read data outside of intended memory boundaries. An attacker can exploit this vulnerability by hosting a malicious webpage; when a user visits the page, the flaw enables code execution within Chrome's security sandbox, potentially leading to information disclosure or further compromise.
Technical details
An out-of-bounds read vulnerability in Chrome's Media component (CVE-2026-87440) allows remote code execution within the Chrome sandbox. The vulnerability is triggered by parsing a crafted HTML page, and no user interaction beyond visiting the malicious page is required. An attacker can leverage this flaw to execute arbitrary code in the sandboxed process; the sandbox may limit direct system access, but code execution within it is still a significant security issue. The vulnerability was patched in Chrome version 153.0.8010.36 and later, which was released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed: CVE-2026-87440 published on NVD
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36 released to stable channel