CVE-2026-87474: Google Chrome Use After Free Vulnerability

CVE-2026-87474 Overview

CVE-2026-87474 is a use-after-free vulnerability [CWE-416] in the Payments component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, granting the attacker access to the host operating system.

Google's Chromium project rates the security severity as High. The vulnerability requires user interaction, such as visiting a malicious website, but no authentication or elevated privileges.

Critical Impact
Attackers can execute arbitrary code outside the Chrome sandbox on the victim's machine through a single crafted web page visit.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Payments component
Desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87474 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87474

Vulnerability Analysis

The vulnerability resides in Chrome's Payments component, which handles the Payment Request API and related payment handler workflows. A use-after-free condition occurs when the browser process references a memory object after it has been released. Attackers can shape the freed memory region to control the contents of the dangling pointer.

When the compromised pointer is dereferenced, the attacker gains control over program execution flow. Because the bug reaches code paths outside the renderer sandbox, exploitation escapes Chrome's isolation boundary. This grants the attacker code execution with the privileges of the browser process on the host system.

The scope change reflected in the impact metrics indicates that a successful attack impacts resources beyond the vulnerable component itself. This aligns with a sandbox escape scenario in which the browser process interacts with the underlying operating system.

Root Cause

The root cause is improper lifetime management of objects within the Payments subsystem. Code paths release an object while another reference remains active, producing a dangling pointer. This class of bug is common in complex C++ codebases such as Chromium and frequently leads to remote code execution.

Attack Vector

An attacker hosts a crafted HTML page containing JavaScript that invokes the Payment Request API in a specific sequence. The victim triggers exploitation by visiting the page or interacting with an embedded frame. The attacker uses heap grooming to place controlled data in the freed allocation before the stale pointer is dereferenced.

See the Chromium Issue Tracker Entry and the Chrome Desktop Update Announcement for additional technical context.

Detection Methods for CVE-2026-87474

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after web browsing activity
Outbound connections from Chrome to newly registered or low-reputation domains hosting payment-themed content
Unexpected file writes to user profile directories originating from the Chrome parent process

Detection Strategies

Monitor endpoints for Chrome versions below 153.0.8010.36 using software inventory tools
Alert on anomalous child process creation from chrome.exe that deviates from normal browser behavior
Inspect web proxy logs for pages invoking the Payment Request API from untrusted origins

Monitoring Recommendations

Enable behavioral endpoint telemetry to capture process lineage, module loads, and memory allocations for browser processes
Correlate browser crash telemetry with sandbox escape indicators such as post-crash privilege elevation
Track DNS and TLS metadata for connections initiated by Chrome to identify malicious landing pages

How to Mitigate CVE-2026-87474

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after patch deployment to ensure the vulnerable process is terminated
Verify browser versions across the fleet and prioritize systems used for financial or administrative tasks

Patch Information

Google released the fix in the Chrome Stable channel update announced on September 8, 2026. Details are documented in the Chrome Desktop Update Announcement. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should also be updated once vendors ship builds incorporating the upstream fix.

Workarounds

Restrict access to untrusted websites through web proxy filtering or DNS-based blocking until patching completes
Enforce browser update policies through group policy or mobile device management to prevent version drift
Consider temporarily disabling the Payment Request API in enterprise environments where payment handlers are not required

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: check bundled version
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString