CVE-2026-87440: Google Chrome Media RCE Vulnerability

CVE-2026-87440 Overview

CVE-2026-87440 is an out-of-bounds read vulnerability [CWE-125] in the Media component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. Exploitation requires user interaction, such as visiting an attacker-controlled URL. Google's Chromium project classified the security severity as High.

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome sandbox through a crafted web page, exposing confidentiality, integrity, and availability of the browser process.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
Chromium-based browsers incorporating the vulnerable Media component
All operating systems supported by the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87440 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87440

Vulnerability Analysis

The flaw resides in the Media subsystem of Chrome, which handles decoding and playback of audio and video content. An out-of-bounds read occurs when the component accesses memory outside the bounds of an allocated buffer while processing malformed media data. Attackers weaponize this by embedding crafted media within an HTML page. When Chrome parses the payload, the read primitive leaks memory or corrupts execution state, ultimately enabling arbitrary code execution inside the renderer sandbox.

Root Cause

The root cause is missing or incorrect bounds validation in the Media component when processing attacker-supplied data structures. The Common Weakness Enumeration classifies this as [CWE-125] Out-of-Bounds Read. Reading past the intended buffer boundary exposes adjacent memory and can be chained with other primitives to achieve control-flow hijack inside the sandboxed process.

Attack Vector

Exploitation occurs over the network. A remote attacker hosts a crafted HTML page that references malformed media content. When the target user visits the page, Chrome's Media component parses the payload and triggers the out-of-bounds read. User interaction is required, but no authentication or elevated privileges are needed. The resulting code execution is confined to the sandbox, meaning a sandbox escape chain would be required to compromise the host.

Refer to the Chromium Issue Tracker #513458719 and the Chrome Release Update September 2026 for technical context.

Detection Methods for CVE-2026-87440

Indicators of Compromise

Chrome renderer processes crashing with access violations while parsing media streams from untrusted domains
Unexpected child process spawning from chrome.exe after navigation to a newly registered or low-reputation domain
Outbound connections from browser processes to unfamiliar hosts immediately after media playback events

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build earlier than 153.0.8010.36
Monitor endpoint telemetry for renderer crashes correlated with HTML pages containing embedded audio or video elements
Correlate browsing telemetry with threat intelligence feeds to identify visits to domains hosting exploit kits targeting Chrome Media

Monitoring Recommendations

Enable browser crash reporting and forward telemetry to a centralized analytics platform for anomaly review
Track process lineage from browser processes to identify anomalous child processes or scripting engine invocations
Alert on Chrome processes performing suspicious memory allocation patterns or spawning shells and LOLBins

How to Mitigate CVE-2026-87440

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all endpoints through managed deployment tooling
Restart Chrome after installation to ensure the patched binaries are loaded into active sessions
Verify version compliance across managed devices and escalate remediation for any endpoint still running vulnerable builds

Patch Information

Google released a fix in the Chrome Stable channel version 153.0.8010.36. Deployment details are available in the Chrome Release Update September 2026. Enterprises using Chromium-derived browsers should confirm the vendor has merged the upstream patch and issued an equivalent update.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering while patches are staged
Enforce Chrome's Site Isolation and Enhanced Safe Browsing to reduce renderer-level exposure
Deploy administrative policies that block auto-play of untrusted media content until updates are applied

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update via enterprise policy (Windows)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f