CVE-2026-87536: Use After Free in V8 in Google Chrome prior to 153.0.8010.36 Allows Remote Code Execution
A NVD · · CVE-2026-87536
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
Use-after-free in V8 enables sandbox bypass with arbitrary code execution,not merely local privilege escalation, but complete browser compromise through remote attack via crafted HTML.
Description
CVE-2026-87536 is a use-after-free vulnerability in Google Chrome's V8 JavaScript engine (versions prior to 153.0.8010.36). An attacker can exploit this flaw through a crafted HTML page to execute arbitrary code within the Chrome sandbox. The Chromium security team rates this as High severity. The sandbox bypass allows the attacker to execute system-wide commands beyond normal browser context. This vulnerability is particularly critical in environments where browsers are used to interact with cloud applications (e.g., Microsoft 365, SharePoint) or to manage infrastructure.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational