CVE-2026-87582 is a confused deputy vulnerability (CWE-441) in the DataTransfer feature of Google Chrome before version 153.0.8010.36. It enables a remote attacker, having control over the renderer process, to escalate privileges and execute arbitrary code outside the sandbox environment via a specially crafted HTML page. This vulnerability requires prior compromise of the renderer process and does not have publicly known exploits or a CVSS score assigned. No official patch or remediation details are currently available.

If exploited, this vulnerability could allow an attacker who has compromised the renderer process to execute arbitrary code outside the sandbox, potentially leading to further system compromise beyond the browser sandbox restrictions. The impact is limited by the prerequisite that the renderer process is already compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should follow best practices to avoid compromising the renderer process, such as avoiding untrusted content and keeping the browser updated.