Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox via a… (CVE-2026-87592)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Description
An out-of-bounds read vulnerability exists in the Tint component of Google Chrome versions prior to 153.0.8010.36. This flaw could allow a remote attacker to potentially read memory inside the sandbox by delivering a crafted HTML page. The Chromium project has assigned this issue a low security severity rating.
Impact
A successful exploit could allow a remote attacker to read memory inside the sandboxed environment of the Chrome browser. This could potentially expose sensitive information from the browser's memory. However, the impact is limited by the sandbox containment and the low severity rating assigned by the Chromium project.
Weaknesses
- CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.