CVE-2026-87618 describes an incorrect reference resolution vulnerability in the Storage subsystem of Google Chrome on Windows versions before 153.0.8010.36. An attacker with control over the renderer process could exploit this flaw to execute arbitrary code outside the sandbox environment by delivering a specially crafted HTML page. This vulnerability is classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference). No CVSS score is provided, and no known exploits are reported in the wild.

Successful exploitation could lead to arbitrary code execution outside the sandbox by an attacker who already has compromised the renderer process. This could potentially increase the attacker's privileges or persistence on the affected system. However, the overall severity is considered low by the Chromium security team, indicating limited impact or difficulty in exploitation.

A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official browser update. No additional mitigation steps are indicated by the vendor.