Secuno
ENNL
Book demo

CVE-2026-87572

8.3 HIGHEPSS 0.31%
  1. Published8 Sept 2026

Description

Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Google Chrome< 153.0.8010.36

Remediation

Fixed in
Google Chrome≥ 153.0.8010.36

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-123558.1
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through…
CVE-2026-123519.8
IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through…
CVE-2026-656699.6
Improper neutralization of special elements in output used by a downstream component…
CVE-2026-862958.3
A vulnerability was found in D-Link DIR-895L A1_102b07. This affects the function…
CVE-2026-796989.9
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB,…
CVE-2026-796979.9
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB,…

Frequently asked

Is CVE-2026-87572 being actively exploited?

CVE-2026-87572 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.31%.

How severe is CVE-2026-87572?

CVE-2026-87572 has a CVSS 3.1 base score of 8.3, rated high. EPSS estimates a 0.31% probability of exploitation.

Which products are affected by CVE-2026-87572?

Affected products include Google Chrome.

How do I fix CVE-2026-87572?

Upgrade affected software to a fixed version, for example Google Chrome 153.0.8010.36 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-87572 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.