CVE-2026-87494: Google Chrome Use After Free Vulnerability

CVE-2026-87494 Overview

CVE-2026-87494 is a use-after-free vulnerability in the Browser component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can leverage social engineering to trick a user into visiting a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. The vulnerability is categorized under CWE-416 (Use After Free). Sandbox escape from a browser process gives an attacker code execution at the privilege level of the logged-in Windows user.

Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox on Windows hosts after a single user interaction with a malicious page.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows systems running vulnerable Chrome builds
Chromium-based deployments sharing the affected Browser component code path

Discovery Timeline

2026-09-09 - CVE-2026-87494 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google issues Stable Channel Update for Desktop addressing the flaw (Google Chrome Update Announcement)

Technical Details for CVE-2026-87494

Vulnerability Analysis

The flaw resides in the Browser process, the privileged parent process in Chrome's multi-process architecture. A use-after-free condition occurs when the Browser process continues to reference an object after its memory has been freed. Attackers manipulate object lifetimes through a crafted HTML page, then reclaim the freed allocation with controlled data. Because the Browser process runs outside the renderer sandbox, successful exploitation yields code execution at the user's privilege level. The AV:N/AC:L/PR:N/UI:R attack profile requires user interaction, consistent with the described social engineering vector.

Root Cause

Use-after-free bugs [CWE-416] arise when code retains a dangling pointer to a heap object after free() or destructor invocation. In browser codebases, these conditions typically stem from mismatched object ownership between event handlers, IPC callbacks, and asynchronous tasks. Google has not publicly disclosed the specific object or subsystem involved. Details remain restricted in the Chromium Issue Tracker Entry pending broad patch adoption.

Attack Vector

Exploitation begins with an attacker-controlled HTML page delivered through phishing, malvertising, or a compromised site. The page triggers the vulnerable code path in the Browser process, then sprays the heap to place attacker data at the freed allocation. When the dangling pointer is reused, the attacker gains control of program flow and executes shellcode outside the renderer sandbox. No authentication is required, and the scope changes because the attacker breaks out of the sandbox security boundary.

No public proof-of-concept exploit has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data as of 2026-09-10 indicates a low near-term exploitation probability, though the sandbox escape impact justifies expedited patching.

Detection Methods for CVE-2026-87494

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections from chrome.exe to unfamiliar domains immediately following user navigation
Unexpected file writes to %APPDATA%, %LOCALAPPDATA%, or startup folders originating from chrome.exe
Chrome versions below 153.0.8010.36 reported by endpoint inventory

Detection Strategies

Hunt for anomalous parent-child process relationships where chrome.exe is the parent of native Windows binaries commonly abused for post-exploitation
Alert on Chrome process crashes accompanied by exception codes consistent with heap corruption, such as 0xC0000005 on freed memory
Correlate browsing telemetry with process creation events to identify malicious pages that trigger sandbox escape behavior

Monitoring Recommendations

Deploy endpoint inventory scans to identify Windows hosts running Chrome versions below 153.0.8010.36
Ingest browser telemetry, DNS logs, and Windows process creation events (Event ID 4688) into a central SIEM for correlation
Monitor Chrome auto-update health so patched builds propagate across managed endpoints

How to Mitigate CVE-2026-87494

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
Verify that Chrome auto-update is enabled and functioning through enterprise policy
Restart Chrome on affected hosts to ensure the patched binary is loaded into memory
Prioritize patching for users with administrative privileges or access to sensitive systems

Patch Information

Google released the fix in the Stable Channel Update for Desktop. Administrators should refer to the Google Chrome Update Announcement for release details and confirm deployment of Chrome 153.0.8010.36 or later across all managed Windows systems.

Workarounds

Restrict browsing to trusted sites through enterprise policy or web filtering until patches are deployed
Enable Enhanced Safe Browsing in Chrome to block known malicious pages
Deploy application allowlisting to prevent unauthorized child processes from launching under chrome.exe
Increase user awareness of phishing and malvertising lures that drive traffic to attacker-controlled pages

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via Group Policy registry key
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f