CVE-2026-87456: Uninitialized resource in Google Chrome

This vulnerability arises from an uninitialized resource in the media handling code of Google Chrome before version 153.0.8010.36. An attacker with control over the renderer process can exploit this flaw by delivering a specially crafted HTML page, enabling them to read memory outside the sandbox environment. This could potentially expose sensitive information from the browser's memory space. The vulnerability is classified as medium severity by Chromium security standards. The vendor advisory confirms the fix is included in Chrome 153.0.8010.36.

A remote attacker who has already compromised the renderer process can leverage this vulnerability to read memory outside the sandbox, potentially exposing sensitive data. However, exploitation requires prior compromise of the renderer process, limiting the attack vector. There are no reports of active exploitation in the wild.

Users should update Google Chrome to version 153.0.8010.36 or later, where this vulnerability is fixed. Since this is a client-side application vulnerability, applying the official update is the recommended remediation. No additional mitigations are specified by the vendor advisory.