CVE-2026-87455: Google Chrome Use After Free Vulnerability

CVE-2026-87455 Overview

CVE-2026-87455 is a use-after-free vulnerability in the Aura component of Google Chrome. The flaw affects all Chrome desktop versions prior to 153.0.8010.36. A remote attacker can trigger memory corruption by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox.

The vulnerability is tracked under [CWE-416] and requires user interaction. Google has released a stable channel update to remediate the issue.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox through a single visit to a malicious web page, bypassing the browser's primary containment boundary.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Aura window management component
Windows, macOS, and Linux Chrome desktop builds

Discovery Timeline

2026-09-09 - CVE-2026-87455 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87455

Vulnerability Analysis

Aura is Chromium's cross-platform window and UI framework that manages windows, event dispatch, and compositor surfaces. A use-after-free condition in Aura allows a remote attacker to reference memory that has already been freed. When the attacker controls the contents of that freed region, execution flow can be redirected to attacker-supplied instructions.

Because Aura executes inside the browser process, exploitation escapes the renderer sandbox that normally contains malicious web content. Code executed in this context inherits the privileges of the browser process itself, providing direct access to the user's host environment.

Root Cause

The defect is a use-after-free ([CWE-416]) in the Aura subsystem. This class of bug arises when an object is released while a dangling pointer or reference is still held elsewhere in the code. A subsequent operation dereferences that stale pointer, reading or writing memory whose contents have been reallocated by attacker-influenced data.

Attack Vector

Exploitation requires the target to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers the page through a compromised website, malvertising, phishing link, or embedded iframe on a trusted site. The crafted content manipulates Aura's window or event lifecycle to trigger the free while retaining a reference to the object. Reuse of the freed allocation with attacker-controlled data then enables code execution outside the renderer sandbox.

No authentication is required. See the Chromium Issue #542565481 tracker for additional technical context once the restriction lifts.

Detection Methods for CVE-2026-87455

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after web navigation
Unexpected outbound network connections from chrome.exe to unfamiliar hosts following a page load
Chrome crash reports referencing Aura window management modules or heap corruption signatures
New files written to user profile directories or startup locations by the Chrome process

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any version below 153.0.8010.36
Monitor process ancestry for browser processes launching unusual binaries or LOLBins
Correlate browser crash telemetry with subsequent suspicious process activity on the same host
Inspect proxy and DNS logs for user visits to newly registered or low-reputation domains preceding crash events

Monitoring Recommendations

Enable endpoint telemetry to capture Chrome process creation, module loads, and network activity
Forward Chrome crash dumps and Windows Error Reporting data to a central analytics platform for review
Alert on script interpreters or persistence artifacts created by browser child processes within a short window of page loads

How to Mitigate CVE-2026-87455

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints without delay
Restart Chrome after applying the update to ensure the patched binaries are loaded
Audit managed browser fleets using enterprise management tooling to confirm patch deployment
Review Chromium-based browsers such as Edge, Brave, and Opera for corresponding vendor updates

Patch Information

Google released the fix in the Chrome Stable channel update documented at the Google Chrome Desktop Update announcement. Upgrade all Chrome desktop clients to 153.0.8010.36 or later. Enterprise administrators should use Chrome Browser Cloud Management or Group Policy to enforce automatic updates.

Workarounds

No official workaround exists; patching is the only complete remediation
Restrict browsing to trusted sites via web content filtering while updates are rolling out
Deploy site isolation and enhanced Safe Browsing policies through Chrome enterprise controls
Consider temporarily disabling third-party content and advertising via enterprise policy to reduce exposure to crafted pages

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows PowerShell: check installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enforce minimum version via Chrome Enterprise policy (Windows registry)
# HKLM\Software\Policies\Google\Chrome\TargetVersionPrefix = "153.0.8010.36"