CVE-2026-87444: Google Chrome Codecs RCE Vulnerability

CVE-2026-87444 Overview

CVE-2026-87444 is a memory corruption vulnerability in the Codecs component of Google Chrome prior to version 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and requires user interaction, such as visiting an attacker-controlled URL. Google rates the underlying Chromium issue as High severity and addressed it in the Stable channel update for desktop.

Critical Impact
Successful exploitation grants arbitrary code execution within the Chrome renderer sandbox, providing a foothold for further sandbox escape and full browser compromise.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Codecs component
Embedded applications bundling affected Chromium builds

Discovery Timeline

2026-09-09 - CVE-2026-87444 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87444

Vulnerability Analysis

The vulnerability resides in the Codecs subsystem of Google Chrome, which handles decoding of media streams delivered through HTML content. Improper enforcement of memory buffer boundaries during codec processing allows attacker-controlled data to corrupt adjacent memory structures. When a victim loads a crafted HTML page, the malformed media payload triggers memory corruption inside the renderer process. This condition enables an attacker to influence control flow and execute arbitrary code within the sandboxed renderer.

Root Cause

The root cause is a memory safety defect classified as [CWE-119]. Codecs parse untrusted media data without adequately validating length or offset fields, leading to out-of-bounds memory access. Google's advisory attributes the flaw to the Codecs component but does not publicly disclose the specific decoder or memory operation involved. Additional context is available in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker hosts a crafted HTML page that references malformed media. When a targeted user visits the page, Chrome's Codecs component processes the payload and triggers the memory corruption. The vulnerability is scoped to the sandbox, meaning code execution is confined to the renderer process unless chained with a sandbox escape.

No public proof-of-concept exploit is available at the time of publication. Technical specifics are described in the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-87444

Indicators of Compromise

Chrome renderer processes crashing with memory access violations after visiting untrusted pages
Unexpected child processes spawned by chrome.exe following media playback
Outbound connections from renderer processes to previously unseen or low-reputation domains
HTML pages referencing malformed or unusual media files delivered from untrusted origins

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 153.0.8010.36
Monitor endpoint telemetry for renderer crashes correlated with media decoding activity
Inspect proxy and web gateway logs for HTML content delivering suspicious media payloads to endpoint browsers

Monitoring Recommendations

Enable browser crash reporting and forward logs to a centralized SIEM for correlation
Track process lineage from chrome.exe to identify anomalous child process creation
Alert on Chrome renderer processes attempting to write to sensitive filesystem or registry locations

How to Mitigate CVE-2026-87444

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart the browser after patching to ensure the updated Codecs component is loaded
Verify Chromium-based browsers and embedded runtimes have received equivalent fixes from their maintainers

Patch Information

Google released the fix in the Stable channel for Desktop. Administrators should deploy Chrome 153.0.8010.36 or newer as described in the Google Chrome Stable Update advisory. Enterprise deployments should validate rollout through group policy or endpoint management tooling.

Workarounds

Enforce strict web filtering to block access to untrusted or newly registered domains hosting media content
Restrict browsing on high-value systems until the patched Chrome version is installed
Disable autoplay of media content in enterprise Chrome policies to reduce exposure to unsolicited codec processing

bash

# Verify the installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify the installed Chrome version on Linux endpoints
google-chrome --version