CVE-2026-87646 , Use After Free in Web Authentication in Google Chrome prior to 153.0.8010.36
A NVD · · CVE-2026-87646
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
The vulnerability enables sandbox escape via crafted HTML pages, allowing attackers to gain system access with Chrome process privileges , beyond typical browser exploits.
Description
CVE-2026-87646 is a use-after-free vulnerability in Google Chrome's Web Authentication implementation prior to version 153.0.8010.36. The vulnerability allows a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page, potentially granting access to the file system and system resources with Chrome process privileges. The vulnerability is rated "High" in Chromium's security classification. No active exploitation in the wild is currently documented, but a prompt update to version 153.0.8010.36 or later is strongly recommended.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.10
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational