Loading vulnerability…
Google Chrome DevTools Injection Leading to Sandbox Escape
CVE-2026-87572 is a high-severity injection vulnerability in DevTools in Google Chrome and Chromium versions before 153.0.8010.36. A remote attacker who has already compromised a renderer process can potentially exploit the vulnerability through a crafted HTML page to execute arbitrary code outside the browser sandbox. The specific vulnerable function and injection mechanism are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could bypass the renderer sandbox and permit arbitrary code execution outside its isolation boundary, potentially compromising data and resources accessible to the resulting execution context. The vulnerability requires prior renderer compromise; it does not independently establish initial code execution in the renderer. Elevated operating-system privileges are not established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until a fixed release is deployed, restrict use of affected browser installations and exposure to untrusted web content. These measures reduce exposure but do not remediate the injection flaw or reliably protect an already-compromised renderer.
Patch, then assume compromise.
Update Google Chrome or Chromium to version 153.0.8010.36 or later; for macOS, deploy 153.0.8010.37 or later. On Debian stable (trixie), upgrade Chromium to 153.0.8010.47-2~deb13u1 or a later fixed package. For Prisma Browser, version 153.3.3.37 addresses this vulnerability's CVE group; version 155.16.5.40 or later covers the complete October security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.