Loading vulnerability…
Google Chrome WebPackaging Use-After-Free Sandbox Escape
CVE-2026-87639 is a high-severity use-after-free vulnerability in the WebPackaging component of Google Chrome before version 153.0.8010.36. A remote attacker who has already compromised the renderer process can potentially exploit the flaw through a crafted HTML page to execute arbitrary code outside the browser sandbox. The specific vulnerable function and memory-lifetime sequence have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could escape the renderer sandbox and execute arbitrary code outside its isolation boundary, potentially compromising the confidentiality, integrity, and availability of resources accessible to the affected process. This vulnerability requires an existing renderer compromise; it is not described as a standalone initial renderer-code-execution vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until updates are deployed, restrict use of unpatched browsers and exposure to untrusted web content. These measures reduce exposure but do not correct the underlying memory-safety flaw.
Patch, then assume compromise.
Update Google Chrome to version 153.0.8010.36 or later on Windows and Linux, and 153.0.8010.37 or later on macOS. For Debian stable (trixie), update Chromium to 153.0.8010.47-2~deb13u1 or a later fixed package. For Prisma Browser, version 153.3.3.37 includes the fix for this CVE; version 155.16.5.40 or later addresses the complete October security advisory. Apply corresponding vendor-provided fixes to other affected Chromium-based browsers.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.