CVE-2026-87506: Privilege elevation in Google Chrome

CVE-2026-87506 is a privilege elevation vulnerability in the WebUI of Google Chrome before version 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to execute arbitrary code outside the sandbox environment. This vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vendor has published a security update to fix this issue.

Successful exploitation allows an attacker who has compromised the renderer process to elevate privileges and execute arbitrary code outside the sandbox, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Google has released an official fix in Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official update.