External risk intelligence

Chrome Media Out of Bounds Write Allows Code Execution Outside Sandbox

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87638

The vulnerability exists in a widely used web browser's media handling components. While it requires user interaction by visiting a crafted HTML page, web browsers are internet-facing applications by design, and users frequently navigate to external content, making this type of attack surface commonly reachable in real-world deployments.

Out-of-bounds Write

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability identified in Google Chrome's media processing, potentially allowing attackers to execute code outside of the browser's secure environment through specially crafted web pages. While the impact is rated as medium, the wide reach of web browsers means this issue warrants attention to confirm its relevance to our specific environment.

Flaw lets malicious sites run code outside browser sandbox.
Widely used browser tech; user visits to websites common.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious HTML page. This page would contain specially crafted media content designed to trigger a flaw in Chrome's media handling. Successful exploitation could allow the attacker to execute code on the user's system, potentially bypassing security sandboxes.

Requires visiting a malicious page.
Vulnerable media processing component.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote attacker could potentially execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. This could affect the integrity and availability of the user's system.

System code and user data integrity.
Visiting a malicious HTML page.
Potential arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome's media handling and could allow for arbitrary code execution outside the sandbox. Owners of applications that render web content or internal portals using Chrome, along with platform teams managing the browser's deployment, should take the lead. The initial step is to identify all Chrome instances, assess their exposure and criticality, and then coordinate remediation, likely involving an expedited update process given the potential for code execution.

Chrome owners and platform teams
Verify Chrome reachability and criticality
Plan expedited browser updates

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and its media components?

Google Chrome is a widely used web browser built on the Chromium engine. Its media components are specialized internal parts responsible for processing audio and video content. These subsystems handle various file formats and streaming protocols, allowing users to play media directly within web pages without needing extra plugins.

What does an out-of-bounds write mean in CVE-2026-87638?

This vulnerability, classified as CWE-787, occurs when the software writes data past the end of a designated memory buffer. In this context, it allows an attacker to overwrite adjacent memory, which can corrupt data or, more critically, enable the execution of unauthorized, arbitrary code.

How is CVE-2026-87638 triggered?

An attacker triggers this flaw by tricking a user into navigating to a specifically crafted HTML page containing malicious media content. The bug is not triggered by standard, benign media files; it requires the browser to process malformed data specifically designed to exploit the memory handling error during media playback.

Do I need to worry about this if my Chrome browser is internal?

Halo Surface Signal notes that browsers are internet-facing by design. Even if used internally, browsers frequently load external content or advertisements that could host the malicious media. Because the attack relies on user interaction—visiting a page—any environment where Chrome processes outside content is relevant.

What are the first steps to address this Chrome vulnerability?

The primary response is to update Google Chrome to version 153.0.8010.36 or newer. Teams managing browser deployments should verify their current version numbers, prioritize patching on systems that frequently access untrusted web content, and ensure that automated update mechanisms are functioning correctly across the organization.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.