Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML… (CVE-2026-87586)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users should update Google Chrome to version 153.0.8010.36 or later once a fix is released.
Description
CVE-2026-87586 is a medium severity vulnerability in the ANGLE component of Google Chrome prior to version 153.0.8010.36. It allows a remote attacker to perform an out-of-bounds read, potentially accessing memory outside the browser's sandbox via a crafted HTML page. No CVSS score or detailed vendor advisory is currently available, and no exploits are confirmed in the wild.
Impact
A successful exploit could allow an attacker to read memory outside the intended sandbox boundaries, potentially exposing sensitive information. However, there is no evidence of active exploitation in the wild at this time.
Weaknesses
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.