CVE-2026-87529
Critical · 9.6CVSS
9.6
EPSS
0.5%
Published
Sep 9, 2026
CISA due date
—
The record
Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer that is… CWE-197
- CVE-2026-80213 An issue was discovered in the resolv gem before 0.7.2 for Ruby. CWE-197
- CVE-2026-77014 A flaw was found in libsoup's SoupServer HTTP Range header processing. CWE-197
- CVE-2026-65610 nnn stores homelen variable as uchar_t, which can only represent values in the range… CWE-197
- CVE-2026-68804 Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to… CWE-197
- CVE-2026-65797 Numeric truncation error in Windows DNS allows an authorized attacker to elevate… CWE-197
- CVE-2026-65798 Numeric truncation error in Windows DNS allows an authorized attacker to elevate… CWE-197
- CVE-2026-65795 Relative path traversal in Windows DNS allows an authorized attacker to elevate… CWE-197