CVE-2026-87460: Google Chrome Use After Free Vulnerability

CVE-2026-87460 is a use after free vulnerability in Google Chrome Platform affecting versions before 153.0.8010.36. Attackers can execute arbitrary code within the sandbox via malicious HTML pages. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2026-87460 Overview

CVE-2026-87460 is a use-after-free vulnerability in the Platform component of Google Chrome prior to version 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by tricking a user into loading a crafted HTML page. The flaw is tracked as CWE-416 and requires user interaction, typically visiting a malicious or compromised website. Google classifies the Chromium security severity as High.

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox, providing an initial foothold that attackers can chain with sandbox escape flaws to achieve full system compromise.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that share the vulnerable Platform component
All operating systems supported by Chrome Stable (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE CVE-2026-87460 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87460

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Chrome Platform component. Use-after-free flaws occur when code continues to reference a memory region after it has been freed, allowing an attacker who controls subsequent heap allocations to place attacker-chosen data at that address. In Chrome, this class of bug typically leads to arbitrary code execution inside the renderer process. The renderer is sandboxed, but code execution there is a prerequisite for chained exploits that break out of the sandbox and target the host operating system. The Chromium project routinely observes this pattern in browser exploitation campaigns.

Root Cause

The root cause is improper object lifetime management within the Platform component. When a referenced object is destroyed but a dangling pointer or reference remains reachable, subsequent operations dereference freed memory. Attackers can groom the heap to reallocate that slot with a controlled object, enabling type confusion or virtual-function pointer hijacking. Google has not publicly released the underlying source patch pending broad user updates. Refer to the Chromium Issue Tracker Entry for restricted technical details.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page that triggers the vulnerable code path when rendered. Delivery vectors include phishing links, malicious advertisements, and compromised legitimate sites. No authentication or elevated privileges are needed on the target. Refer to the Chrome Release Update for the vendor advisory.

No verified proof-of-concept code is publicly available. Technical details are described in prose per available references.

Detection Methods for CVE-2026-87460

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures such as EXCEPTION_ACCESS_VIOLATION referencing freed heap chunks
Outbound connections from chrome.exe child processes to newly registered or low-reputation domains immediately after browsing activity
Unexpected child processes spawned by Chrome, particularly shell interpreters or LOLBins

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build older than 153.0.8010.36
Correlate browser crash telemetry with subsequent process creation and network events to surface post-exploitation activity
Apply behavioral analytics on browser child-process chains to identify anomalous execution originating from renderer processes

Monitoring Recommendations

Ingest browser telemetry, process creation events, and DNS logs into a centralized data lake for cross-source correlation
Alert on Chrome version drift after patch deployment cycles
Monitor threat intelligence feeds for exploit development activity referencing CVE-2026-87460 or Chromium issue 540058837

How to Mitigate CVE-2026-87460

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart the Chrome process on every user session to ensure the patched binary is loaded
Audit Chromium-based third-party browsers and apply upstream security updates as they become available

Patch Information

Google addressed the vulnerability in the Stable Channel desktop update announced in the Chrome Release Update. Chrome auto-update deploys the fix when the browser is relaunched. Enterprise administrators using Group Policy or MDM should validate that the update channel is not blocked and confirm the deployed version equals or exceeds 153.0.8010.36.

Workarounds

Enforce Chrome auto-update via Group Policy and disable user-controlled deferrals
Restrict browsing to trusted sites through URL allowlisting where operational risk warrants it
Enable Site Isolation and Enhanced Safe Browsing to raise the exploitation cost against renderer-based flaws

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion