Loading vulnerability…
Sandboxed remote code execution in Google Chrome Input
CVE-2026-87542 is a high-severity use-after-free vulnerability in the Input component of Google Chrome before version 153.0.8010.36. A remote attacker can trigger the vulnerability through a crafted HTML page, potentially executing arbitrary code within the browser sandbox. The specific vulnerable function and detailed triggering conditions have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the Chrome sandbox, compromising the affected sandboxed execution context. Sandbox escape, host-level code execution, and privilege escalation are not established consequences of this vulnerability alone. No active exploitation is reported for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, restrict use of affected browser installations and reduce exposure to untrusted web content through web-content controls or browser isolation. Preserve browser sandboxing as a containment measure; it does not prevent exploitation of the underlying use-after-free.
Patch, then assume compromise.
Update Google Chrome to version 153.0.8010.36 or later; the applicable macOS advisory recommends 153.0.8010.37 or later. For Debian stable (trixie), upgrade Chromium to 153.0.8010.47-2~deb13u1 or later. For Prisma Browser, version 153.3.3.37 incorporates the fix for this CVE's vulnerability group; version 155.16.5.40 or later addresses the complete October security advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.