CVE-2026-87497

Analyzed Analyzed - Analysis Complete

Uninitialized Memory Read in Google Chrome Codecs

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Chrome

Description

Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87497

EUVD

EUVD-2026-74341

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability is an uninitialized resource issue in Codecs within Google Chrome before version 153.0.8010.36. It allows a remote attacker to read memory inside the sandbox by exploiting a crafted HTML page. The impact is limited due to the sandbox environment, but it still poses a risk of information exposure.

Detection Guidance

I don't know

Detection requires checking the installed version of Google Chrome. Compare the version against 153.0.8010.36 or later.

Impact Analysis

If you use an affected version of Google Chrome, this vulnerability could allow an attacker to read sensitive memory data from within the sandbox. This might lead to exposure of personal or confidential information, though the sandbox limits the attacker's ability to escalate privileges or directly harm your system.

Compliance Impact

This vulnerability allows a remote attacker to read memory inside the sandbox via a crafted HTML page, which could potentially expose sensitive data. This may impact compliance with GDPR by risking unauthorized access to personal data and HIPAA by risking exposure of protected health information if such data is processed in the affected environment.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later to address the uninitialized resource issue.

Hi! I’m here to help you understand CVE-2026-87497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70