Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… (CVE-2026-87647)
Source GCVE Database
Not known to be exploited : patch affected systems soon.
Data as of 10/24/2026, 17:08:27 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionschromium/chromiumpkg:github/chromium/chromiumOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should update to Google Chrome version 153.0.8010.36 or later once the fix is officially released. Until then, limiting exposure to untrusted content and maintaining strict renderer process security controls is advisable.
Description
Google Chrome versions prior to 153.0.8010.36 contain a high severity vulnerability involving an uninitialized GPU resource. A remote attacker who has already compromised the renderer process can exploit this flaw to read memory outside the sandbox by using a crafted HTML page. This vulnerability is identified as CVE-2026-87647 and relates to improper initialization of GPU resources.
Impact
The vulnerability enables a remote attacker with prior access to the renderer process to read memory outside the sandbox, potentially exposing sensitive information. This can lead to information disclosure beyond the intended security boundaries of the browser sandbox.