Google Chrome CVE-2026-87506

Exploitation requires two sequential conditions: (1) the attacker must first achieve arbitrary code execution within the Chrome renderer process via a separate vulnerability - this WebUI flaw is not independently reachable from a clean renderer state; and (2) the victim must visit a crafted HTML page (UI:R), providing the delivery vehicle for the renderer compromise. CVSS AC:H captures the complexity of requiring a pre-compromised renderer. Exploitation is not automatable (SSVC: Automatable: no) because the multi-stage chain cannot be reliably and consistently triggered at scale. Limiting factors: requires a second, independent renderer exploit; requires user interaction; does not affect Chrome mobile (Android/iOS) via this specific CPE; no current public exploit code exists.

The CVSS 8.3 score with S:C and C:H/I:H/A:H correctly captures the severity of a successful sandbox escape, but AC:H is the critical qualifier - exploitation requires a pre-compromised renderer process, meaning this flaw cannot be reached without chaining it with a separate, independent renderer vulnerability. Chromium's own internal severity rating of 'Medium' (vs. the 8.3 high-tier CVSS) reflects this dependency on a multi-step chain. EPSS of 0.21% at the 12th percentile is low, and SSVC reports exploitation status as 'none' with automatable set to 'no', aligning with the expectation that opportunistic mass exploitation is not feasible given the prerequisite. No public exploit code exists and no KEV listing has been issued. Real-world risk is meaningful primarily for targeted attack scenarios involving sophisticated actors who already possess a renderer exploit - the combined chain delivers full system compromise, so any organization running Chrome versions below 153.0.8010.36 should prioritize the patch.

An attacker crafts a malicious HTML page that first exploits a separate renderer vulnerability to achieve code execution inside the Chrome sandbox, then uses this WebUI privilege elevation flaw to escape the sandbox and execute arbitrary code in the context of the broader browser or OS process. The victim visits the attacker-controlled page in an unpatched Chrome browser, triggering the full two-stage chain. No public proof-of-concept for this specific flaw has been identified at time of analysis.