CVE-2026-87587: Use-after-free in V8 in Google Chrome prior to 153.0.8010.36 allows remote code execution via crafted HTML page
A NVD · · CVE-2026-87587
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
A use-after-free vulnerability in the V8 JavaScript engine enables attackers to achieve remote code execution within the Chrome sandbox via crafted HTML pages.
Description
CVE-2026-87587 is a use-after-free vulnerability in V8, Google Chrome's JavaScript engine. It allows attackers to execute arbitrary code within the Chrome sandbox by loading a crafted HTML page. The Chromium security team rates the vulnerability as "High" severity. The flaw affects Chrome versions prior to 153.0.8010.36. There are currently no reports of active exploitation in the wild.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational