CVE-2026-87456: Google Chrome Information Disclosure

CVE-2026-87456 Overview

CVE-2026-87456 is an uninitialized resource vulnerability [CWE-908] in the Media component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can read memory outside the sandbox by serving a crafted HTML page. Google classified the underlying Chromium issue as Medium severity, while the NVD assigned a lower CVSS score reflecting the high attack complexity and requirement for a prior renderer compromise. The flaw exposes process memory but does not directly permit code execution or data modification.

Critical Impact
Successful exploitation leaks memory contents across the sandbox boundary, which can be chained with other bugs to strengthen a full sandbox escape.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers using the vulnerable Media component
Downstream distributions that ship pre-patched Chromium builds

Discovery Timeline

2026-09-09 - CVE-2026-87456 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87456

Vulnerability Analysis

The vulnerability resides in the Media subsystem of Chrome and stems from the use of an uninitialized resource. When the renderer processes specific media content delivered through a crafted HTML page, the code path reads from memory that was never explicitly initialized. The uninitialized bytes can contain residual data from prior allocations belonging to other objects or components in the browser process.

The attack model assumes the adversary has already compromised the renderer process through a separate exploit. From that position, the flaw permits reading memory outside the renderer sandbox boundary. The bug does not directly grant arbitrary code execution or data tampering. Its practical value lies in leaking pointers, secrets, or layout information that support subsequent exploitation stages.

The CVSS vector reflects a network attack vector with high complexity and required user interaction, and the scope change indicates that impact crosses the sandbox trust boundary.

Root Cause

The root cause is classified under [CWE-908]: Use of Uninitialized Resource. A buffer or object allocated in the Media component is consumed before all fields receive defined values. Downstream logic then treats those bytes as valid content and exposes them through observable side effects reachable from a compromised renderer.

Attack Vector

Exploitation requires two conditions. First, the attacker must lure a user to load a crafted HTML page that triggers the vulnerable media processing path. Second, the attacker must already control the renderer process via a prior vulnerability. Once both conditions are met, the attacker issues requests that cause the Media component to return uninitialized memory contents, which the compromised renderer reads across the sandbox boundary. Full technical details are tracked in Chromium Issue #496231550.

Detection Methods for CVE-2026-87456

Indicators of Compromise

Chrome renderer processes exhibiting unusual media decoding activity followed by anomalous IPC traffic to the browser process.
Chrome installations reporting version strings earlier than 153.0.8010.36 in endpoint inventory data.
Web traffic delivering crafted media payloads from newly registered or low-reputation domains.

Detection Strategies

Inventory browser versions across managed endpoints and flag hosts still running Chrome builds below 153.0.8010.36.
Correlate browser crash telemetry, renderer sandbox violations, and abnormal media codec errors to surface exploitation attempts.
Monitor for chained exploitation patterns where a renderer compromise precedes attempts to access cross-process memory.

Monitoring Recommendations

Ingest Chrome update and crash telemetry into the SIEM to detect repeat renderer failures on the same host.
Track outbound connections from browser child processes for unexpected destinations or data volumes.
Alert on endpoints that lag behind the enterprise-standard Chrome version for more than one patch cycle.

How to Mitigate CVE-2026-87456

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after deployment so the patched binary is loaded into memory.
Verify Chromium-based browsers such as Edge, Brave, and Opera have absorbed the upstream fix.

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update. Administrators should confirm client versions report 153.0.8010.36 or later. Additional engineering context is available in Chromium Issue #496231550.

Workarounds

Enforce Chrome auto-update policies through group policy or MDM to eliminate version drift.
Restrict browsing to trusted sites via web filtering while patch deployment is in progress.
Disable or limit access to non-essential media features in enterprise Chrome policies where feasible.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv