High severity8.3NVD Advisory· Published Sep 9, 2026· Updated Sep 10, 2026
CVE-2026-87628
CVE-2026-87628
Description
Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
Affected products
5- osv-coords2 versionspkg:rpm/opensuse/chromium&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed
< 153.0.8010.36-bp160.1.1+ 1 more
- (no CPE)range: < 153.0.8010.36-bp160.1.1
- (no CPE)range: < 153.0.8010.36-1.1
Patches
Vulnerability mechanics
References
2- chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.htmlnvdRelease NotesVendor Advisory
- issues.chromium.org/issues/553770012nvdPermissions Required
News mentions
3- Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside SandboxThe Hacker News · Sep 9, 2026
- Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the WildCyber Security News · Sep 9, 2026
- Chromium: 25 Vulnerabilities Patched, Including Exploited V8 Zero-DayVypr Intelligence · Sep 9, 2026