Google Chrome Stable Update Fixes Eight High-Severity Memory Safety Vulnerabilities

Eight vulnerabilities patched in one update

Chrome's Stable Channel update released on September 8, 2026 addresses eight separate CVEs: CVE-2026-87512 (use-after-free in ANGLE), CVE-2026-87528 (type confusion in Rust), CVE-2026-87637 (use-after-free in Extensions), CVE-2026-87643 (integer overflow in GPU), CVE-2026-87527 (buffer overflow in WebGL), CVE-2026-87448 (use-after-free in DevTools), CVE-2026-87558 (use-after-free in Payments), and CVE-2026-87581 (use-after-free in Payments). Each advisory describes exploitation via a crafted HTML page.

Memory safety issues across multiple components

The vulnerabilities stem from distinct root causes: use-after-free conditions (CWE-416) affect ANGLE, Extensions, DevTools, and Payments (two separate instances); a type confusion issue (CWE-843) affects Rust code; a buffer overflow (CWE-122) affects WebGL; and an integer overflow (CWE-190) affects GPU handling. All are described as allowing a remote attacker to execute, or potentially execute, arbitrary code outside the sandbox via a crafted HTML page. One of the Payments issues (CVE-2026-87581) additionally notes that exploitation could involve social engineering.

Sandbox escape potential

Each of the eight CVEs is described as potentially allowing code execution outside Chrome's sandbox, which is the primary isolation mechanism protecting the host system from malicious web content. Chromium's own internal severity ratings for the individual bugs range from Low to Critical, though all were assigned the same CVSS base score of 9.6 in this fact package.

Platform scope

Some advisories specify a platform: CVE-2026-87512 and CVE-2026-87528 affect Chrome on Windows, CVE-2026-87637 and CVE-2026-87558 affect Chrome on Mac, and CVE-2026-87643 affects Chrome on Android. The remaining advisories (CVE-2026-87527, CVE-2026-87448, CVE-2026-87581) do not specify a platform restriction in the source descriptions, which may indicate they affect Chrome across all desktop platforms, but this is not explicitly confirmed in the available facts.

Versions prior to the fix

All eight vulnerabilities affect versions of Google Chrome prior to 153.0.8010.36. No earlier affected version boundary is specified in the fact package.

Fixed in version 153.0.8010.36

Google has released Chrome 153.0.8010.36 for desktop, which resolves all eight vulnerabilities listed in this briefing. Chrome's built-in auto-update mechanism will typically apply this update automatically; users can also trigger an update manually via the browser's settings menu.

Update Chrome without delay

Site owners and users should confirm that Chrome is running version 153.0.8010.36 or later. Given the number of sandbox-escape-capable flaws patched in this release and their uniformly high CVSS score, applying the update promptly is advised. A browser restart is typically required to complete the update.