Google Chrome Stable Update Fixes Eight Vulnerabilities, Several Allowing Code Execution

Overview of the fixed vulnerabilities

Google's Chrome Stable channel update addresses eight separate CVEs: CVE-2026-87654 (buffer overflow in ANGLE, Windows-specific), CVE-2026-87638 (out of bounds write in Media), CVE-2026-87547 (incorrect reference resolution in FileSystem), CVE-2026-87474 (use after free in Payments), CVE-2026-87613 (incorrect reference resolution in Extensions), CVE-2026-87612 (type confusion in V8), CVE-2026-87542 (use after free in Input), and CVE-2026-87433 (race condition in FileAPI). Several of these are classified by Chromium's internal severity rating as High; others as Medium.

Root causes vary by component

The vulnerabilities stem from different underlying weakness classes: buffer overflow (CWE-122) in CVE-2026-87654; out of bounds write (CWE-787) in CVE-2026-87638; incorrect reference resolution (CWE-706) in both CVE-2026-87547 and CVE-2026-87613; use after free (CWE-416) in both CVE-2026-87474 and CVE-2026-87542; type confusion (CWE-843) in CVE-2026-87612; and a race condition (CWE-367) in CVE-2026-87433. Most descriptions indicate exploitation via a crafted HTML page; CVE-2026-87613 instead references crafted network traffic.

Potential for sandbox escape and code execution

Several of the vulnerabilities (CVE-2026-87654, CVE-2026-87638, CVE-2026-87547, CVE-2026-87474, CVE-2026-87613) are described as potentially allowing a remote attacker to execute arbitrary code outside the Chrome sandbox, which would represent a significant compromise of the host system beyond the browser process itself. CVE-2026-87612 and CVE-2026-87542 describe code execution inside the sandbox, which is a lesser but still serious impact. CVE-2026-87433 describes a site isolation bypass requiring prior renderer compromise, making it a secondary-stage issue rather than an initial-access vector.

Affected users

All users running Google Chrome on desktop prior to version 153.0.8010.36 are affected. CVE-2026-87654 is specifically noted as affecting the Windows build of Chrome; the other seven vulnerabilities are not described as platform-specific in the available facts.

Affected and fixed versions

All eight vulnerabilities affect Google Chrome versions prior to 153.0.8010.36. No earlier affected version boundary is specified in the available data. The fix for all eight issues is included in Chrome 153.0.8010.36.

Fix available

Google has released Chrome 153.0.8010.36 for desktop, which resolves all eight vulnerabilities described in this briefing. No workaround is documented; updating to the fixed version is the remediation path confirmed by the vendor source.

What to do

Update Google Chrome to version 153.0.8010.36 or later as soon as possible. Chrome typically updates automatically on restart, but administrators managing fleets of browsers should verify that the update has been applied, particularly given the number of high-severity issues addressed in this release.