Executive brief
Google Chrome's FileSystem component contains a flaw where file references are resolved incorrectly, allowing attackers to potentially execute arbitrary code outside Chrome's security sandbox. A user would need to be tricked into visiting a malicious website for the attack to succeed. A successful exploit could allow attackers to run malicious code with full system privileges, bypassing Chrome's protections and potentially compromising the entire computer.
Technical details
The vulnerability is a reference resolution flaw in Chrome's FileSystem implementation that enables code execution outside the sandbox. The attack requires social engineering to deliver a crafted HTML page to the victim; there are no authentication or network-layer preconditions beyond visiting an attacker-controlled site. The vulnerability allows a remote attacker to achieve arbitrary code execution with the privilege level of the browser process, fully escaping the sandbox isolation layer. The issue was patched in Chrome 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-08: disclosed: Chrome 153.0.8010.36 released with fix
- 2026-09-09: advisory: CVE-2026-87547 published