Description
Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-09-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Memory corruption in Chrome’s codec implementation allows a remote attacker to run arbitrary code inside the browser sandbox through a crafted HTML page. The flaw is a classic out-of-bounds write (CWE‑119, CWE‑787), classified by Chromium as a high‑severity vulnerability.

Affected Systems

Google Chrome versions earlier than 153.0.8010.36 are vulnerable. Any user who visits a malicious web page while using one of these versions is at risk.

Risk and Exploitability

The vulnerability's severity is high, with a CVSS score of 8.8, but its exploit probability is not quantified by EPSS and it is not yet listed in CISA’s KEV catalog. Because the attack vector is a web page accessed by users, the risk to all Chrome users is substantial until the update is applied. The flaw can be exploited remotely without additional credentials, requiring only that the victim load a maliciously crafted page.

Generated by OpenCVE AI on September 9, 2026 at 13:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.36 or later to receive the required fix.
  • As a temporary workaround, restrict or block access to media content from untrusted sites or disable the affected codec features via browser policies until the patch can be deployed.
  • Enable Chrome’s enhanced sandbox configuration or apply the least‑privilege settings to renderer processes to reduce the impact of any exploit until the fix is installed.

Generated by OpenCVE AI on September 9, 2026 at 13:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Wed, 09 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 09 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome Codecs Memory Corruption Enables Remote Code Execution chromium-browser: chromium-browser: Memory corruption in Codecs
Weaknesses CWE-787
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 09 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Title Chrome Codecs Memory Corruption Enables Remote Code Execution

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-119
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T03:55:32.292Z

Reserved: 2026-09-08T22:22:55.083Z

Link: CVE-2026-87444

cve-icon Vulnrichment

Updated: 2026-09-09T12:56:35.475Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T01:17:00.677

Modified: 2026-09-10T04:18:19.220

Link: CVE-2026-87444

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-09T00:09:32Z

Links: CVE-2026-87444 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T10:45:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write