CVE-2026-87480: Google Chrome Use After Free Vulnerability

CVE-2026-87480 Overview

CVE-2026-87480 is a use-after-free vulnerability [CWE-416] in the Printing component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to execute arbitrary code outside the Chrome sandbox. Google classifies the Chromium security severity as High. The flaw enables a sandbox escape, one of the most valuable primitives in a modern browser exploit chain. Successful exploitation elevates attacker capabilities from renderer-confined code execution to full code execution in the browser process context.

Critical Impact
Attackers chaining a prior renderer compromise with CVE-2026-87480 can escape the Chrome sandbox and execute arbitrary code on the host, undermining a core browser security boundary.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that embed the vulnerable Printing component
Downstream distributions shipping Chrome/Chromium before the fixed release

Discovery Timeline

2026-09-09 - CVE-2026-87480 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87480

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) condition inside Chrome's Printing subsystem. A UAF occurs when code continues to reference memory that has already been freed, allowing an attacker to control the contents of the reclaimed allocation. In the browser process context, this primitive can be shaped into arbitrary read, write, or control-flow hijacking.

Exploitation requires the attacker to first compromise the renderer process. The renderer then sends specifically crafted messages or triggers printing-related lifecycle events that reach the vulnerable code path in a more privileged process. Because Printing logic crosses the renderer-to-browser trust boundary, corrupting freed objects there yields code execution outside the sandbox.

The attack requires user interaction and the attack complexity is rated High, reflecting the need to win a race or manipulate object lifetimes deterministically. The scope change indicates that impact extends beyond the vulnerable component into the host system.

Root Cause

The root cause is improper object lifetime management within the Printing component. A reference to a printing-related object persists after the object has been destroyed. When that dangling reference is later dereferenced, the underlying memory may be reallocated with attacker-influenced data, leading to type confusion or virtual call hijacking.

Attack Vector

Delivery is network-based. An attacker hosts a crafted HTML page and induces a victim to visit it. The page first triggers a separate renderer compromise, then invokes printing-related APIs or DOM interactions that reach the flawed code path. Because the sink resides outside the renderer sandbox, successful exploitation escapes the sandbox boundary. No verified public proof-of-concept is available at time of writing. See Chromium Issue #553928324 for tracking details.

Detection Methods for CVE-2026-87480

Indicators of Compromise

Chrome browser processes spawning unexpected child processes or shells following visits to untrusted web pages
Crash reports referencing the Printing component or PrintRenderFrameHelper, PrintViewManager, or related classes
Outbound connections from chrome.exe to newly registered or low-reputation domains shortly after page loads

Detection Strategies

Hunt for anomalous process lineage where Chrome parents cmd.exe, powershell.exe, bash, or scripting interpreters
Correlate browser crash telemetry with subsequent process creation, file writes to persistence locations, or credential access activity
Deploy behavioral endpoint detection that flags post-exploitation actions such as unsigned binary drops from browser working directories

Monitoring Recommendations

Track installed Chrome versions across the fleet and alert on hosts below 153.0.8010.36
Ingest browser telemetry and endpoint process data into a central analytics platform for cross-signal correlation
Monitor the Google Chrome Stable Update advisory feed for follow-on fixes

How to Mitigate CVE-2026-87480

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after applying the update so the patched binaries load into memory
Prioritize patching for users who handle sensitive data or browse externally exposed content

Patch Information

Google addressed CVE-2026-87480 in the Chrome Stable channel release 153.0.8010.36. Details are published in the Google Chrome Stable Update advisory. Chromium-based browser vendors should pull the corresponding upstream fix and issue coordinated updates. Enterprises using managed Chrome deployments should validate that auto-update policies are enabled and unblocked by proxy or firewall rules.

Workarounds

No vendor-supplied workaround exists; patching is the only complete mitigation
Restrict browsing to trusted sites through URL filtering until the update is deployed
Apply enterprise policy to disable non-essential printing features where feasible to reduce attack surface

bash

# Verify Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Confirm the reported version is 153.0.8010.36 or higher