Google Chrome CVE-2026-87529

Requires the victim to open attacker-controlled web content (UI:R) in a vulnerable Chrome build (before 153.0.8010.36) that processes the crafted media triggering the truncation in the Media component - no authentication or prior privileges needed (PR:N). Limiting factors: mandatory user interaction (loading the page), the vendor's 'potentially' wording and Chromium 'Medium' rating indicating the full sandbox escape may need to be chained with additional primitives, and applicability only to unpatched desktop Chrome; auto-updated browsers are quickly out of scope.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated sandbox escape requiring only that the user open a page - a serious profile because scope changes (S:C) reflect crossing the sandbox boundary. However, Chromium itself rated the issue only 'Medium', a meaningful downgrade signal suggesting real-world exploitability is more constrained than the 9.6 implies (the description hedges with 'potentially execute arbitrary code'). No EPSS score, no KEV listing, and no POC are present in the input, so there is no evidence of active or imminent exploitation. Net: patch on the normal Chrome cadence - high theoretical impact, but the vendor severity, mandatory user interaction, and absence of exploitation signals argue against emergency out-of-band treatment. The CVSS-vs-Chromium-severity discrepancy should be reconciled against Google's own advisory.

An attacker hosts or injects (via malvertising or a compromised site) a page containing crafted media content that triggers the numeric truncation in Chrome's Media component; when a victim visits with a vulnerable Chrome build, the resulting memory corruption is chained to escape the sandbox and run attacker code on the host. No credentials are needed, but the victim must open the page (UI:R). No public exploit is identified at time of analysis.