Tools AI-Found Vulnerability Register aifv-0070
Register entry
Chrome WebPackaging use-after-free, reported by OpenAI Codex Security
- CVE
- CVE-2026-87639
- Project
- Google Chrome
- Component
- WebPackaging
- Finder
- OpenAI Codex Security
- Autonomy
- credited to the product with a person's handle in brackets; the split between agent and person is unstated
- Evidence tier
- CNA credits the finder in its own advisory
- Assigner
- Chrome
- Severity
- High (Chromium severity)
- Bounty
- Chrome Vulnerability Reward Program
- Confidence
- CONFIRMED
What happened
A high-severity use-after-free in Chrome's WebPackaging, fixed in Chrome 153.0.8010.36 and credited to OpenAI Codex Security in the Stable Channel Update of 8 September 2026. It was reported to Chrome on 9 August 2026. The CVE record says it allowed a remote attacker who had already compromised the renderer process to potentially run code outside the sandbox.
Credit as recorded: High CVE-2026-87639: Use after free in WebPackaging. Reported by OpenAI Codex Security (amyb) on 2026-08-09. The CVE record's credits field is empty, so the attribution rests on Chrome's release note, where the reward column reads TBD. Codex Security is the OpenAI product the Aardvark rows on this tracker became in March 2026. Chrome's stable updates of 8, 22 and 29 September 2026 carry this credit on six fixes. Date basis: release note.
Sources
- CVE record, cvelistV5 mirrorraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Chrome Releases, Stable Channel Update, 8 September 2026chromereleases.googleblog.com/2026/09/stable-channel-update-…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 8 October 2026